CVE-2014-9684

OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service (disk consumption) by creating a large number of images using the task v2 API and then deleting them before the uploads finish, a different vulnerability than CVE-2015-1881.

OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service (disk consumption) by creating a large number of images using the task v2 API and then deleting them before the uploads finish, a different vulnerability than CVE-2015-1881.

OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service (disk consumption) by creating a large number of images using the task v2 API and then deleting them before the uploads finish, a different vulnerability than CVE-2015-1881.

OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service (disk consumption) by creating a large number of images using the task v2 API and then deleting them before the uploads finish, a different vulnerability than CVE-2015-1881.

OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service (disk consumption) by creating a large number of images using the task v2 API and then deleting them before the uploads finish, a different vulnerability than CVE-2015-1881.

OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service (disk consumption) by creating a large number of images using the task v2 API and then deleting them before the uploads finish, a different vulnerability than CVE-2015-1881.

This update provides the following fixes provided from the upstream OpenStack-project:

• openstack-suse:

  • do not copy upstream python requirements to the package, we rely on Requires; upstream requirements.txt introduce version caps which we do not follow (bnc#920573)

• openstack-sahara:

  • Fix getting heat stack in Sahara
  • Fixed scaling with new node group with auto sg
  • Open all ports for private network for auto SG
  • Fix for getting auth url for hadoop-swift
  • Fixed auto security group cleanup in case of creation error
  • Add list of open ports for Cloudera plugin
  • Add missed files for migrations in MANIFEST.in
  • Include launch_command.py in MANIFEST.in
  • Fix requires

• openstack-keystone:

  • Updated hybrid backend to include fix for bsc#935892
  • Deal with PEP-0476 certificate chaining checking
  • Backport fixes for v3 API sample policy file (lp#1381809 and lp#1392155).
  • Install v3 sample policy into the doc directory
  • Update hybrid backend to include latest fixes for v3 protocol (bsc#928718)
  • backend_argument should be marked secret
  • Work with pymongo 3.0
  • Speed up memcache lock
  • Fix up _ldap_res_to_model for ldap identity backend
  • Don't try to convert LDAP attributes to boolean
  • Fix the wrong update logic of catalog kvs driver
  • Do parameter check before updating endpoint_group
  • Correct initialization order for logging to use eventlet locks
  • Fix the syntax issue on creating table endpoint_group

• openstack-heat:

  • Add env storing for loaded environments
  • Fix block_device_mapping property validation when using get_attr
  • Add default_client_name in Nova::FloatingIPAssoc
  • Fix cloud-init Python syntax for Python < 2.6
  • Allow lists and strings for Json parameters via provider resources
  • RandomString physical_resource_id as id not the string
  • Authenticate the domain user with id instead of username
  • Tell stevedore not to force verify requirements
  • Use properties.data when testing for 'provided by the user'
  • Ship /usr/lib/heat directory in openstack-heat-engine subpackage, since that's where plugin are loaded from.
  • Create openstack-heat-plugin-heat_docker subpackage to ship the heat_docker plugin.
  • Fix update on failed stack
  • Enable https for keystone while creating stack user
  • Change the engine-listener topic
  • Just to delete the stack when adopt rollback
  • Release stack lock when successfully acquire
  • Add dependency on Router External Gateway property
  • Use only FIP dependencies from graph
  • Add dependency hidden on router_interface
  • Update heat.conf.sample
  • Upgrade requirements for kombu and greenlet to Juno versions (bnc#920573)
  • Stop patching oslo.messaging private bits

• openstack-glance:

  • Eventlet green threads not released back to pool
  • Replace assert statements with proper control-flow
  • Fix intermittent unit test failures
  • Initiate deletion of image files if the import was interrupted to prevent denial of service (bnc#918784, CVE-2014-9684)

• openstack-cinder:

  • Remove nonexistent LIO terminate_connection call
  • Disallow backing files when uploading volumes to image
  • LVM: Pass volume size in MiB to copy_volume() during volume migration
  • Remove iscsi_helper calls from base iscsi driver
  • Fix exceptions logging in iSCSI targets
  • Delete the temporary volume if migration fails
  • Get the 'consumer' in a correct way for retyping with qos-specs
  • Fix re-export of iscsi volume when using lioadm
  • Revert 'Add support for customized cluster name'
  • Failed to discovery when iscsi multipath and CHAP both enabled
  • Add support for customized cluster name
  • Only use operational LIFs for iscsi target details
  • Clear migration_status from a destination volume if migration fails
  • Deal with PEP-0476 certificate chaining checking

• openstack-ceilometer:

  • Ensure unique list of consumers created
  • Add bandwidth to measurements
  • Rely on VM UUID to fetch metrics in…