Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 735
Alerts This Week
Warning Icon 1 735

Red Hat: RHSA-2015:0790-01 Important: OpenStack-Nova Cross-Site Attack

red hat
Calendar Grey April 7, 2015
Dist Redhat Esm H88
The latest openstack-nova release addresses a critical security vulnerability, providing vital updates for users of Red Hat Enterprise Linux OpenStack.
Updated openstack-nova packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux OpenStack Platform 6.0

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Summary

OpenStack Compute (nova) launches and schedules large networks of virtual machines, creating a redundant and scalable cloud computing platform. Compute provides the software, control panels, and APIs required to orchestrate a cloud, including running virtual machine instances and controlling access through users and projects.
It was discovered that the OpenStack Compute (nova) console websocket did not correctly verify the origin header. An attacker could use this flaw to conduct a cross-site websocket hijack attack. Note that only Compute setups with VNC or SPICE enabled were affected by this flaw. (CVE-2015-0259)
Red Hat would like to thank the OpenStack project for reporting this issue. Upstream acknowledges Brian Manifold of Cisco, and Paul McMillan of Nebula as the original reporters.
In addition to the above issue, this update also addresses bugs and enhancements which are documented in the Red Hat Enterprise Linux OpenStack Platform Technical Notes, linked to in the References section.
All openstack-nova users are advised to upgrade to these updated packages, which correct these issues and add these enhancements.

Topics%20covered

Topics Covered

security advisory Red Hat bug fix important update virtual machine OpenStack cross-site attack

References

https://access.redhat.com/security/cve/CVE-2015-0259 https://access.redhat.com/security/updates/classification#important

Package List

Red Hat Enterprise Linux OpenStack Platform 6.0 for RHEL 7:
Source: openstack-nova-2014.2.2-19.el7ost.src.rpm
noarch: openstack-nova-2014.2.2-19.el7ost.noarch.rpm openstack-nova-api-2014.2.2-19.el7ost.noarch.rpm openstack-nova-cells-2014.2.2-19.el7ost.noarch.rpm openstack-nova-cert-2014.2.2-19.el7ost.noarch.rpm openstack-nova-common-2014.2.2-19.el7ost.noarch.rpm openstack-nova-compute-2014.2.2-19.el7ost.noarch.rpm openstack-nova-conductor-2014.2.2-19.el7ost.noarch.rpm openstack-nova-console-2014.2.2-19.el7ost.noarch.rpm openstack-nova-doc-2014.2.2-19.el7ost.noarch.rpm openstack-nova-network-2014.2.2-19.el7ost.noarch.rpm openstack-nova-novncproxy-2014.2.2-19.el7ost.noarch.rpm openstack-nova-objectstore-2014.2.2-19.el7ost.noarch.rpm openstack-nova-scheduler-2014.2.2-19.el7ost.noarch.rpm openstack-nova-serialproxy-2014.2.2-19.el7ost.noarch.rpm python-nova-2014.2.2-19.el7ost.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key


Severity
important
Lowest
Low
Medium
High
Critical

Advisory ID: RHSA-2015:0790-01
Product: Red Hat Enterprise Linux OpenStack Platform
Advisory URL: https://access.redhat.com/errata/RHSA-2015:0790.html
Issue date: 2015-04-07

Topic

Updated openstack-nova packages that fix one security issue, several bugs,and add various enhancements are now available for Red Hat Enterprise LinuxOpenStack Platform 6.0.Red Hat Product Security has rated this update as having Important securityimpact. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available from the CVE link in theReferences section.

Topics%20covered

Topics Covered

security advisory Red Hat bug fix important update virtual machine OpenStack cross-site attack

Relevant Releases Architectures

Red Hat Enterprise Linux OpenStack Platform 6.0 for RHEL 7 - noarch

Bugs Fixed

1017288 - [Blocked] Snapshots on GlusterFS w/ libgfapi enabled

1100535 - [RFE][nova]: Add a virt driver for Ironic

1104926 - [RFE][nova]: I/O (PCIe) Based NUMA Scheduling

1171454 - Launching an instance with muliple interfaces attached to same network by using --net-id fails

1190112 - CVE-2015-0259 openstack-nova: console Cross-Site WebSocket hijacking

1190719 - when using dedicated cpus, the emulator thread should be affined as well

1191174 - Cinder volume fails to attach when multipathing in Nova and Storwize CHAPS are enabled

1203182 - Launching an instance fails when using a port with vnic_type=direct

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.