Red Hat: 2014:0090-01: openstack-heat: Moderate Advisory

    Date22 Jan 2014
    1484
    Posted ByJoe Shakespeare
    Updated openstack-heat packages that fix two security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux OpenStack Platform 4.0. [More...]
    =====================================================================
                       Red Hat Security Advisory
    
    Synopsis:          Moderate: openstack-heat security, bug fix, and enhancement update
    Advisory ID:       RHSA-2014:0090-01
    Product:           Red Hat OpenStack
    Advisory URL:      https://rhn.redhat.com/errata/RHSA-2014-0090.html
    Issue date:        2014-01-22
    CVE Names:         CVE-2013-6426 CVE-2013-6428 
    =====================================================================
    
    1. Summary:
    
    Updated openstack-heat packages that fix two security issues, several bugs,
    and add various enhancements are now available for Red Hat Enterprise Linux
    OpenStack Platform 4.0.
    
    The Red Hat Security Response Team has rated this update as having moderate
    security impact. Common Vulnerability Scoring System (CVSS) base scores,
    which give detailed severity ratings, are available for each vulnerability
    from the CVE links in the References section.
    
    2. Relevant releases/architectures:
    
    OpenStack 4 - noarch
    
    3. Description:
    
    The openstack-heat packages provide heat, a Python implementation of the
    OpenStack Orchestration engine, to launch multiple composite cloud
    applications based on templates.
    
    It was found that heat did not properly enforce cloudformation-compatible
    API policy rules. An in-instance attacker could use the CreateStack or
    UpdateStack methods to create or update a stack, resulting in a violation
    of the API policy. Note that only setups using Orchestration's
    cloudformation-compatible API were affected. (CVE-2013-6426)
    
    A flaw was found in the way Orchestration's REST API implementation handled
    modified request paths. An authenticated remote user could use this flaw to
    bypass the tenant-scoping restriction by modifying the request path,
    resulting in privilege escalation. Note that only setups using
    Orchestration's cloudformation-compatible API were affected.
    (CVE-2013-6428)
    
    Red Hat would like to thank Jeremy Stanley of the OpenStack Project for
    reporting these issues. Upstream acknowledges Steven Hardy of Red Hat as
    the original reporter.
    
    The openstack-heat packages have been upgraded to upstream version
    2013.2.1, which provides a number of bug fixes and enhancements over the
    previous version. The most notable fixes and enhancements are:
    
    * Auto-scaling has been fixed when AdjustmentType was set to
      PercentChangeInCapacity.
    
    * A QPID broker restart no longer permanently disrupts subscribed clients.
    
    * RPC requests are now only serviced by one server in a given topic group.
    
    * Auto-scaling group growth or shrinkage has been fixed to utilize the full
      available size, regardless of the scaling policy adjustment.
    
    (BZ#1045430)
    
    This update also fixes the following bugs:
    
    * The outdated heat-db-setup tool, which only supported local installs, has
    been removed. The Red Hat Enterprise Linux OpenStack Platform 4
    Installation and Configuration Guide has been updated to show how to create
    the necessary database and associated tables for Orchestration, allowing
    the deployment of the database server on a local or remote system (see
    Installing the OpenStack Orchestration Service). (BZ#1046326)
    
    * The heat-engine source code had a hard-coded reference to a Fedora image
    name in the implementation of the AWS-compatible LoadBalancer resource.
    This meant that you could not specify an alternative LoadBalancer image
    name in deployments (for example, Red Hat Enterprise Linux). A new option
    has been added to the Orchestration configuration file,
    /etc/heat/heat.conf, which is named loadbalancer_template. The new
    loadbalancer_template option can now be used to specify an alternate
    LoadBalancer template that contains a different image name. (BZ#1048215)
    
    * Due to a packaging error, the heat-manage tool was not working properly
    (which prohibited a successful database creation). This error has been
    fixed by moving the parallel package selection code so that all
    Orchestration tools now use the proper packages for use at runtime.
    (BZ#1048335)
    
    All openstack-heat users are advised to upgrade to these updated packages,
    which correct these issues and add these enhancements.
    
    4. Solution:
    
    Before applying this update, make sure all previously released errata
    relevant to your system have been applied.
    
    This update is available via the Red Hat Network. Details on how to use the
    Red Hat Network to apply this update are available at
    https://access.redhat.com/site/articles/11258
    
    Documentation for releases of Red Hat Enterprise Linux OpenStack Platform
    is available at
    https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux_OpenStack_Platform/
    
    5. Bugs fixed (https://bugzilla.redhat.com/):
    
    1039141 - CVE-2013-6426 OpenStack Heat: CFN policy rules not all enforced
    1039144 - CVE-2013-6428 OpenStack Heat: ReST API doesn't respect tenant scoping
    1046326 - remove heat-db-setup from openstack-heat packaging
    1048335 - heat-manage doesn't work on EL
    
    6. Package List:
    
    OpenStack 4:
    
    Source:
    ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/RHOS/SRPMS/openstack-heat-2013.2.1-4.el6ost.src.rpm
    
    noarch:
    openstack-heat-api-2013.2.1-4.el6ost.noarch.rpm
    openstack-heat-api-cfn-2013.2.1-4.el6ost.noarch.rpm
    openstack-heat-api-cloudwatch-2013.2.1-4.el6ost.noarch.rpm
    openstack-heat-common-2013.2.1-4.el6ost.noarch.rpm
    openstack-heat-engine-2013.2.1-4.el6ost.noarch.rpm
    
    These packages are GPG signed by Red Hat for security.  Our key and
    details on how to verify the signature are available from
    https://access.redhat.com/security/team/key/#package
    
    7. References:
    
    https://www.redhat.com/security/data/cve/CVE-2013-6426.html
    https://www.redhat.com/security/data/cve/CVE-2013-6428.html
    https://access.redhat.com/security/updates/classification/#moderate
    https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux_OpenStack_Platform/
    
    8. Contact:
    
    The Red Hat security contact is .  More contact
    details at https://access.redhat.com/security/team/contact/
    
    Copyright 2014 Red Hat, Inc.
    

    LinuxSecurity Poll

    What do you think of the LinuxSecurity Privacy news articles?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/25-what-do-you-think-of-the-linuxsecurity-privacy-news-articles?task=poll.vote&format=json
    25
    radio
    [{"id":"90","title":"Love them!","votes":"48","type":"x","order":"1","pct":88.89,"resources":[]},{"id":"91","title":"I'm indifferent","votes":"4","type":"x","order":"2","pct":7.41,"resources":[]},{"id":"92","title":"Not interested in this topic","votes":"2","type":"x","order":"3","pct":3.7,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.