Skip to content
OpenAdvisories
Unscored SUSE-RU-2015:1730-1 1 CVE

Recommended update for various Crowbar barclamps and OpenStack components

Published Sep 15, 2015 · Updated Feb 4, 2026

Summary

This update provides fixes and enhancements for various Crowbar barclamps and
OpenStack components.

crowbar-barclamp-ceilometer:

- Do not assume ceilometer-agent-hyperv is listed in elements. (bsc#937117)

crowbar-barclamp-cinder:

- Fix hideShow toggle of password_field in backends. (bsc#919963)

crowbar-barclamp-neutron:

- Set dhcp_agents_per_network option. (bsc#928189)
- Set dhcp_agents_per_network only in HA mode. (bsc#934651)
- Allocate SDN IP for NSX nodes. (bsc#934688)
- Pass keystone admin password to neutron-ha-tool via file. (bsc#922751)
- Use lower MTU value for GRE+VXLAN tunnels. (bsc#917328)
- Allow Nova to work with ssl-keystone. (bsc#895594)

crowbar-barclamp-nova:

- Add support for Docker as tech preview. (fate#317913)
- Enable the 2.1 API. (bsc#934225)
- Fix parsing of 'virsh secret-list' header. (bsc#931284)
- Allow neutron+glance+cinder to work with ssl-keystone. (bsc#895594)

openstack-neutron:

- Change neutron-ha-tool to read password from /etc/neutron/os_password.
(bsc#922751)
- Allow images with existing routes in the network 169.254.0.0/16 to access
metadata server. (bnc#915245)

openstack-nova:

- Backport of the NUMA checks from the master branch. (bsc#931043)
- Fix metadata not returning just instance private IP. (bsc#934523)
- Enable tenant/user specific instance filtering. (bsc#927625)
- Cleanup allocated networks after rescheduling. (bsc#931839)
- Websocket Proxy should verify Origin header to prevent Cross-Site
WebSocket hijacking. (bsc#917091, CVE-2015-0259)

The packages crowbar-barclamp-keystone, crowbar-barclamp-hyperv and
openstack-resource-agents also received bug fixes and enhancements.
For a comprehensive list of changes please refer to each package's
change log.

Fixed packages 11

ReleasePackageFixed in
SUSE · OpenStack Cloud 5 crowbar-barclamp-ceilometer 1.9+git.1438201205.04a7436-9.8
SUSE · OpenStack Cloud 5 crowbar-barclamp-cinder 1.9+git.1438200979.c385b03-10.8
SUSE · OpenStack Cloud 5 crowbar-barclamp-hyperv 1.9+git.1432022529.1952009-10.8
SUSE · OpenStack Cloud 5 crowbar-barclamp-keystone 1.9+git.1438197158.e32ec9e-10.7
SUSE · OpenStack Cloud 5 crowbar-barclamp-neutron 1.9+git.1438265717.eb633ae-9.8
SUSE · OpenStack Cloud 5 crowbar-barclamp-nova 1.9+git.1438201051.f8b5f34-9.8
SUSE · OpenStack Cloud 5 openstack-neutron 2014.2.4~a0~dev78-13.4
SUSE · OpenStack Cloud 5 openstack-neutron-doc 2014.2.4~a0~dev78-13.9
SUSE · OpenStack Cloud 5 openstack-nova 2014.2.4~a0~dev61-11.4
SUSE · OpenStack Cloud 5 openstack-nova-doc 2014.2.4~a0~dev61-11.4
SUSE · OpenStack Cloud 5 openstack-resource-agents 1.0+git.1417010594.e813e10-9.2

Vulnerabilities 1

  • Medium —

    OpenStack Compute (Nova) has Insufficient Verification of Data Authenticity

    OpenStack Compute (Nova) before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket requests, which allows remote attackers to hijack the authentication of users for access to consoles via a crafted webpage.

References

  • report
    https://bugzilla.suse.com/895594
  • report
    https://bugzilla.suse.com/915245
  • report
    https://bugzilla.suse.com/917091
  • report
    https://bugzilla.suse.com/917328
  • report
    https://bugzilla.suse.com/919963
  • report
    https://bugzilla.suse.com/922751
  • report
    https://bugzilla.suse.com/927625
  • report
    https://bugzilla.suse.com/928189
  • report
    https://bugzilla.suse.com/931043
  • report
    https://bugzilla.suse.com/931284
  • report
    https://bugzilla.suse.com/931839
  • report
    https://bugzilla.suse.com/934225
  • report
    https://bugzilla.suse.com/934523
  • report
    https://bugzilla.suse.com/934651
  • report
    https://bugzilla.suse.com/934688
  • report
    https://bugzilla.suse.com/937117
  • web
    https://www.suse.com/security/cve/CVE-2015-0259