Login
Newsletter
Werbung

Sicherheit: Mangelnde Rechteprüfung in openstack-nova
Aktuelle Meldungen Distributionen
Name: Mangelnde Rechteprüfung in openstack-nova
ID: FEDORA-2012-0682
Distribution: Fedora
Plattformen: Fedora 16
Datum: Fr, 20. Januar 2012, 10:32
Referenzen: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0030
Applikationen: OpenStack

Originalnachricht

Name        : openstack-nova
Product : Fedora 16
Version : 2011.3.1
Release : 0.4.10818.fc16
URL : http://openstack.org/projects/compute/
Summary : OpenStack Compute (nova)
Description :
OpenStack Compute (codename Nova) is open source software designed to
provision and manage large networks of virtual machines, creating a
redundant and scalable cloud computing platform. It gives you the
software, control panels, and APIs required to orchestrate a cloud,
including running instances, managing networks, and controlling access
through users and projects. OpenStack Compute strives to be both
hardware and hypervisor agnostic, currently supporting a variety of
standard hardware configurations and seven major hypervisors.

-------------------------------------------------------------------------------
-
Update Information:

Update to 2011.3.1 release candidate. See https://launchpad.net/nova/+milestone/2011.3.1

This also includes a minor bug fix for libguestfs file injection

This update includes ~50 patches from the upstream stable branch and a fix for
an issue with attaching volumes.

Sync up with Fedora spec, to only add fuse group if present. Explicitly depend
on the fuse package to avoid #767852. Requires manually installing "fuse" first.

Also adds libguestfs update

Add --yes, --rootpw, and --novapw arguments to openstack-nova-db-setup.

Please ensure you have at least python-migrate-0.6-6 installed when testing
this

Change the default database from sqlite to mysql.
-------------------------------------------------------------------------------
-
ChangeLog:

* Wed Jan 18 2012 Mark McLoughlin <markmc@redhat.com> -
2011.3.1-0.4.10818.fc16
- Update to latest 2011.3.1 release candidate
- Re-add nova-{clear-rabbit-queues,instance-usage-audit}
* Tue Jan 17 2012 Mark McLoughlin <markmc@redhat.com> -
2011.3.1-0.3.10814
- nova-stack isn't missing after all
* Tue Jan 17 2012 Mark McLoughlin <markmc@redhat.com> -
2011.3.1-0.2.10814
- nova-{stack,clear-rabbit-queues,instance-usage-audit} temporarily removed
because of lp#917676
* Tue Jan 17 2012 Mark McLoughlin <markmc@redhat.com> -
2011.3.1-0.1.10814
- Update to 2011.3.1 release candidate
- Only adds 4 patches from upstream which we didn't already have
* Wed Jan 11 2012 Pádraig Brady <P@draigBrady.com> - 2011.3-19
- Fix libguestfs support for specified partitions
- Fix tenant bypass by authenticated users using API (#772202, CVE-2012-0030)
* Fri Jan 6 2012 Mark McLoughlin <markmc@redhat.com> - 2011.3-18
- Fix up recent patches which don't apply
* Fri Jan 6 2012 Mark McLoughlin <markmc@redhat.com> - 2011.3-17
- Backport tgtadm off-by-one fix from upstream (#752709)
* Fri Jan 6 2012 Mark McLoughlin <markmc@redhat.com> - 2011.3-16
- Rebase to latest upstream stable/diablo, pulling in ~50 patches
* Fri Jan 6 2012 Mark McLoughlin <markmc@redhat.com> - 2011.3-15
- Move recent patches into git (no functional changes)
* Fri Dec 30 2011 Pádraig Brady <P@draigBrady.com> - 2011.3-14
- Don't require the fuse group (#770927)
- Require the fuse package (to avoid #767852)
* Wed Dec 14 2011 Pádraig Brady <P@draigBrady.com> - 2011.3-13
- Sanitize EC2 manifests and image tarballs (#767236, CVE 2011-4596)
- update libguestfs support
* Tue Dec 6 2011 Russell Bryant <rbryant@redhat.com> - 2011.3-11
- Add --yes, --rootpw, and --novapw options to openstack-nova-db-setup.
* Wed Nov 30 2011 Pádraig Brady <P@draigBrady.com> - 2011.3-10
- Add libguestfs support
* Tue Nov 29 2011 Pádraig Brady <P@draigBrady.com> - 2011.3-9
- Update the libvirt dependency from 0.8.2 to 0.8.7
- Ensure we don't access the net when building docs
* Tue Nov 29 2011 Russell Bryant <rbryant@redhat.com> - 2011.3-8
- Change default database to mysql. (#735012)
* Mon Nov 14 2011 Mark McLoughlin <markmc@redhat.com> - 2011.3-7
- Add ~20 significant fixes from upstream stable branch
* Wed Oct 26 2011 Mark McLoughlin <markmc@redhat.com> - 2011.3-6
- Fix password leak in EC2 API (#749385, CVE 2011-4076)
* Mon Oct 24 2011 Mark McLoughlin <markmc@redhat.com> - 2011.3-5
- Fix block migration (#741690)
-------------------------------------------------------------------------------
-
References:

[ 1 ] Bug #740456 - Cannot terminate instance after compute node reboot
https://bugzilla.redhat.com/show_bug.cgi?id=740456
[ 2 ] Bug #752709 - Failure to attach a volume
https://bugzilla.redhat.com/show_bug.cgi?id=752709
[ 3 ] Bug #767251 - CVE 2011-4596 openstack-nova: Sanitize EC2 manifests and
image tarballs [fedora-16]
https://bugzilla.redhat.com/show_bug.cgi?id=767251
-------------------------------------------------------------------------------
-

This update can be installed with the "yum" update program. Use
su -c 'yum update openstack-nova' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
-------------------------------------------------------------------------------
-
_______________________________________________
package-announce mailing list
package-announce@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/package-announce
Pro-Linux
Gewinnspiel
Neue Nachrichten
Werbung