Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 556
Alerts This Week
Warning Icon 1 556

Red Hat OpenStack 3.0: RHSA-2014:0366-01 Moderate: Compute Service Issues

red hat
Calendar Grey April 3, 2014
Dist Redhat Esm H88
This bulletin addresses considerable security vulnerabilities within the openstack-nova packages for Red Hat Enterprise Linux.
Updated openstack-nova packages that fix three security issues and one bug are now available for Red Hat Enterprise Linux OpenStack Platform 3.0

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258

Summary

OpenStack Compute (nova) launches and schedules large networks of virtual machines, creating a redundant and scalable cloud computing platform. Compute provides the software, control panels, and APIs required to orchestrate a cloud, including running virtual machine instances, managing networks, and controlling access through users and projects.
A flaw was found in the way the libvirt driver handled short-lived disk back-up files on Compute nodes. An authenticated attacker could use this flaw to create a large number of such files, exhausting all available space on Compute node disks, and potentially causing a denial of service. Note that only Compute setups using the libvirt driver were affected. (CVE-2013-7048)
It was discovered that the libvirt driver did not properly handle live migration of virtual machines. An authenticated attacker could use this flaw to gain access to a snapshot of a migrated virtual machine. Note that only setups using KVM live block migration were affected. (CVE-2013-7130)
It was found that OpenStack Compute did not properly reapply existing security groups after migrating or resizing a virtual machine. This could cause virtual machine instances to be unintentionally exposed on the network. Note that only setups using the XenAPI back end were affected. (CVE-2013-4497)
Red Hat would like to thank the OpenStack Project for reporting CVE-2013-7130. Upstream acknowledges Loganathan Parthipan as the original reporter of CVE-2013-7130.
This update also fixes the following bug:
* Prior to this update, the cache mechanism did not consider existing network interfaces when building the nework list. After any change in the network interfaces, only the interface modified last was shown when listing or getting the details of an instance. With this update, the cache mechanism considers all existing instances when it is being refreshed. (BZ#1038239)
All openstack-nova users are advised to upgrade to these updated packages, which correct these issues.

Topics%20covered

Topics Covered

security advisory bug fix Denial of Service Moderate Red Hat OpenStack openstack-nova Compute

References

https://access.redhat.com/security/cve/CVE-2013-4497 https://access.redhat.com/security/cve/CVE-2013-7048 https://access.redhat.com/security/cve/CVE-2013-7130 https://access.redhat.com/security/updates/classification#moderate

Package List

OpenStack 3:
Source:
noarch: openstack-nova-2013.1.5-2.el6ost.noarch.rpm openstack-nova-api-2013.1.5-2.el6ost.noarch.rpm openstack-nova-cells-2013.1.5-2.el6ost.noarch.rpm openstack-nova-cert-2013.1.5-2.el6ost.noarch.rpm openstack-nova-common-2013.1.5-2.el6ost.noarch.rpm openstack-nova-compute-2013.1.5-2.el6ost.noarch.rpm openstack-nova-conductor-2013.1.5-2.el6ost.noarch.rpm openstack-nova-console-2013.1.5-2.el6ost.noarch.rpm openstack-nova-doc-2013.1.5-2.el6ost.noarch.rpm openstack-nova-network-2013.1.5-2.el6ost.noarch.rpm openstack-nova-objectstore-2013.1.5-2.el6ost.noarch.rpm openstack-nova-scheduler-2013.1.5-2.el6ost.noarch.rpm python-nova-2013.1.5-2.el6ost.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key#package


Advisory ID: RHSA-2014:0366-01
Product: Red Hat OpenStack
Advisory URL: https://access.redhat.com/errata/RHSA-2014:0366.html
Issue date: 2014-04-03

Topic

Updated openstack-nova packages that fix three security issues and one bugare now available for Red Hat Enterprise Linux OpenStack Platform 3.0.The Red Hat Security Response Team has rated this update as having Moderatesecurity impact. Common Vulnerability Scoring System (CVSS) base scores,which give detailed severity ratings, are available for each vulnerabilityfrom the CVE links in the References section.

Topics%20covered

Topics Covered

security advisory bug fix Denial of Service Moderate Red Hat OpenStack openstack-nova Compute

Relevant Releases Architectures

OpenStack 3 - noarch

Bugs Fixed

1026171 - CVE-2013-4497 openstack-nova: XenAPI security groups not kept through migrate or resize

1038239 - nova interface-attach causes existing networks to be shown as replaced by new one when "nova show" is run

1040786 - CVE-2013-7048 Openstack Nova: insecure directory permissions in snapshots

1055400 - CVE-2013-7130 OpenStack nova: Live migration can leak root disk into ephemeral storage

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.