Summary
This update provides fixes and enhancements for various Crowbar barclamps and
OpenStack components.
crowbar-barclamp-ceilometer:
- Do not assume ceilometer-agent-hyperv is listed in elements. (bsc#937117)
crowbar-barclamp-cinder:
- Fix hideShow toggle of password_field in backends. (bsc#919963)
crowbar-barclamp-neutron:
- Set dhcp_agents_per_network option. (bsc#928189)
- Set dhcp_agents_per_network only in HA mode. (bsc#934651)
- Allocate SDN IP for NSX nodes. (bsc#934688)
- Pass keystone admin password to neutron-ha-tool via file. (bsc#922751)
- Use lower MTU value for GRE+VXLAN tunnels. (bsc#917328)
- Allow Nova to work with ssl-keystone. (bsc#895594)
crowbar-barclamp-nova:
- Add support for Docker as tech preview. (fate#317913)
- Enable the 2.1 API. (bsc#934225)
- Fix parsing of 'virsh secret-list' header. (bsc#931284)
- Allow neutron+glance+cinder to work with ssl-keystone. (bsc#895594)
openstack-neutron:
- Change neutron-ha-tool to read password from /etc/neutron/os_password.
(bsc#922751)
- Allow images with existing routes in the network 169.254.0.0/16 to access
metadata server. (bnc#915245)
openstack-nova:
- Backport of the NUMA checks from the master branch. (bsc#931043)
- Fix metadata not returning just instance private IP. (bsc#934523)
- Enable tenant/user specific instance filtering. (bsc#927625)
- Cleanup allocated networks after rescheduling. (bsc#931839)
- Websocket Proxy should verify Origin header to prevent Cross-Site
WebSocket hijacking. (bsc#917091, CVE-2015-0259)
The packages crowbar-barclamp-keystone, crowbar-barclamp-hyperv and
openstack-resource-agents also received bug fixes and enhancements.
For a comprehensive list of changes please refer to each package's
change log.
Fixed packages 11
| Release | Package | Fixed in |
|---|---|---|
| SUSE · OpenStack Cloud 5 | crowbar-barclamp-ceilometer | 1.9+git.1438201205.04a7436-9.8 |
| SUSE · OpenStack Cloud 5 | crowbar-barclamp-cinder | 1.9+git.1438200979.c385b03-10.8 |
| SUSE · OpenStack Cloud 5 | crowbar-barclamp-hyperv | 1.9+git.1432022529.1952009-10.8 |
| SUSE · OpenStack Cloud 5 | crowbar-barclamp-keystone | 1.9+git.1438197158.e32ec9e-10.7 |
| SUSE · OpenStack Cloud 5 | crowbar-barclamp-neutron | 1.9+git.1438265717.eb633ae-9.8 |
| SUSE · OpenStack Cloud 5 | crowbar-barclamp-nova | 1.9+git.1438201051.f8b5f34-9.8 |
| SUSE · OpenStack Cloud 5 | openstack-neutron | 2014.2.4~a0~dev78-13.4 |
| SUSE · OpenStack Cloud 5 | openstack-neutron-doc | 2014.2.4~a0~dev78-13.9 |
| SUSE · OpenStack Cloud 5 | openstack-nova | 2014.2.4~a0~dev61-11.4 |
| SUSE · OpenStack Cloud 5 | openstack-nova-doc | 2014.2.4~a0~dev61-11.4 |
| SUSE · OpenStack Cloud 5 | openstack-resource-agents | 1.0+git.1417010594.e813e10-9.2 |
Vulnerabilities 1
-
Medium —
OpenStack Compute (Nova) has Insufficient Verification of Data Authenticity
OpenStack Compute (Nova) before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket requests, which allows remote attackers to hijack the authentication of users for access to consoles via a crafted webpage.
References
-
report
https://bugzilla.suse.com/895594
-
report
https://bugzilla.suse.com/915245
-
report
https://bugzilla.suse.com/917091
-
report
https://bugzilla.suse.com/917328
-
report
https://bugzilla.suse.com/919963
-
report
https://bugzilla.suse.com/922751
-
report
https://bugzilla.suse.com/927625
-
report
https://bugzilla.suse.com/928189
-
report
https://bugzilla.suse.com/931043
-
report
https://bugzilla.suse.com/931284
-
report
https://bugzilla.suse.com/931839
-
report
https://bugzilla.suse.com/934225
-
report
https://bugzilla.suse.com/934523
-
report
https://bugzilla.suse.com/934651
-
report
https://bugzilla.suse.com/934688
-
report
https://bugzilla.suse.com/937117
-
web
https://www.suse.com/security/cve/CVE-2015-0259