CVE-2017-17051

An issue was discovered in the default FilterScheduler in OpenStack Nova 16.0.3. By repeatedly rebuilding an instance with new images, an authenticated user may consume untracked resources on a hypervisor host leading to a denial of service, aka doubled resource allocations. This regression was introduced with the fix for OSSA-2017-005 (CVE-2017-16239); however, only Nova stable/pike or later deployments with that fix applied and relying on the default FilterScheduler are affected.

An issue was discovered in the default FilterScheduler in OpenStack Nova 16.0.3. By repeatedly rebuilding an instance with new images, an authenticated user may consume untracked resources on a hypervisor host leading to a denial of service, aka doubled resource allocations. This regression was introduced with the fix for OSSA-2017-005 (CVE-2017-16239); however, only Nova stable/pike or later deployments with that fix applied and relying on the default FilterScheduler are affected.

An issue was discovered in the default FilterScheduler in OpenStack Nova 16.0.3. By repeatedly rebuilding an instance with new images, an authenticated user may consume untracked resources on a hypervisor host leading to a denial of service, aka doubled resource allocations. This regression was introduced with the fix for OSSA-2017-005 (CVE-2017-16239); however, only Nova stable/pike or later deployments with that fix applied and relying on the default FilterScheduler are affected.

This update for ardana-ansible, ardana-db, ardana-freezer, ardana-glance, ardana-input-model, ardana-nova, ardana-osconfig, ardana-tempest, caasp-openstack-heat-templates, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, documentation-suse-openstack-cloud, galera-python-clustercheck, openstack-cinder, openstack-glance, openstack-heat, openstack-horizon-plugin-monasca-ui, openstack-horizon-plugin-neutron-fwaas-ui, openstack-ironic, openstack-keystone, openstack-manila, openstack-monasca-agent, openstack-monasca-api, openstack-monasca-persister, openstack-monasca-persister-java, openstack-murano, openstack-neutron, openstack-neutron-gbp, openstack-neutron-lbaas, openstack-nova, openstack-octavia, python-Beaver, python-oslo.db, python-osprofiler, python-swiftlm, venv-openstack-magnum, venv-openstack-monasca, venv-openstack-monasca-ceilometer, venv-openstack-murano, venv-openstack-neutron fixes the following issues:

• Update to version 8.0+git.1560208949.67048e3:

  • Adds repository list parameter (bsc#1122825)

• Update to version 8.0+git.1564410318.f0cca2c:

  • Don't use 'latest' with 'zypper' (SOC-9997)

• Update to version 8.0+git.1564164977.ef9baeb:

  • Freezer Config file is mixed case (SOC-9700)

• Update to version 8.0+git.1564491709.349d78e:

  • Default glance_default_store to rbd if SES enabled (SOC-8749)

• Update to version 8.0+git.1562848601.c3daff0:

  • Include memcached in the minimal ardana-ci model (SOC-9800)

• Update to version 8.0+git.1565388406.c6abb8d:

  • Make default/rpc_response_timeout configurable (SOC-9285)

• Update to version 8.0+git.1562943864.e04a92f:

  • Resolves nova-novncproxy random status failures (SOC-9574)

• Update to version 8.0+git.1560180700.bd26898:

  • Adding support for qemu-ovmf to ardana (SOC-8985)

• Update to version 8.0+git.1563383198.c7fd9b4:

  • Add an global_filter entry to lvm.conf (bsc#1140512)

• Update to version 8.0+git.1559761021.5605746:

  • Enable FCOE for SUSE platform family (SCRD-8562)

• Update to version 8.0+git.1562849010.73bc517:

  • Fix Keystone only deployment tempest testing (SOC-9800)

• Update to version 8.0+git.1560764545.6c8d2dc:

  • Install manila tempest tests package (SOC-7496)

• Update to version 8.0+git.1560330843.b7d807c:

  • Add configuration for manila-tempest-plugin (SOC-7496)

• Update to version 1.0+git.1560518045.ad7dc6d:

  • Patching node before bootstraping

• Update to version 5.0+git.1565280360.01fed6905:

  • batch: Fix get_proposal_json (SOC-9954)
  • batch: Format crowbar batch error output (SOC-9954)
  • batch: Format crowbar batch error output (SOC-9954)

• Update to version 5.0+git.1564657662.75174c965:

  • travis: Whitelist CVE-2015-3448 (SOC-9911)
  • travis: Use env variable for commit range (SOC-9911)
  • Use proper names for the Travis Tests (SOC-9565)
  • Replace Danger with Gitlint (SOC-9565)
  • Switch from Travis dist from Trusty to Xenial (SOC-9565)

• Update to version 5.0+git.1563983933.03880f1c8:

  • dns: fix migration for designate

• Update to version 5.0+git.1562080799.f2dd7d0dd:

  • network: Don't set datapath-ids on ovs-bridges anymore
  • crowbar: Save sync_mark attributes in databag

• Update to version 5.0+git.1561648142.b6be652e9:

  • dns: forwards dns queries to dns-master when using desingate
  • dns: write admin network in ip/mask notation for bind9
  • dns: skip installing designate-rndc-key on non-master nodes
  • dns: fix designate migration
  • dns: allow using dns-server as designate target
  • bind: Allow new zones configured via rndc
  • bind: Disable listening on IPv6 addresses for now

• Update to version 5.0+git.1561465092.4dc67a7fa:

  • travis: pin sexp_processor to 4.12.0

• Update to version 5.0+git.1561380950.b4e37c0e2:

  • deployer: Use dhcp on crowbar_register only when enable_pxe is set (bsc#1132654)
  • network: Allow locking down the network config for nodes (bsc#1120657)

• Update to version 5.0+git.1562069707.e2de18c:

  • Add timeout multiplier
  • Make default sync_mark timeout…

This update for ardana-ansible, ardana-barbican, ardana-cinder, ardana-cluster, ardana-cobbler, ardana-db, ardana-designate, ardana-extensions-nsx, ardana-glance, ardana-heat, ardana-horizon, ardana-input-model, ardana-installer-ui, ardana-ironic, ardana-keystone, ardana-logging, ardana-magnum, ardana-monasca, ardana-mq, ardana-neutron, ardana-nova, ardana-octavia, ardana-opsconsole, ardana-opsconsole-ui, ardana-osconfig, ardana-service, ardana-ses, ardana-swift, ardana-tempest, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, java-monasca-common, java-monasca-common-kit, openstack-ceilometer, openstack-cinder, openstack-designate, openstack-heat, openstack-horizon-plugin-neutron-fwaas-ui, openstack-horizon-plugin-neutron-lbaas-ui, openstack-horizon-plugin-neutron-vpnaas-ui, openstack-ironic, openstack-ironic-python-agent, openstack-keystone, openstack-magnum, openstack-manila, openstack-monasca-notification, openstack-monasca-persister, openstack-monasca-persister-java, openstack-monasca-persister-java-kit, openstack-neutron, openstack-neutron-gbp, openstack-neutron-lbaas, openstack-nova, openstack-octavia, openstack-tempest, python-ardana-configurationprocessor, python-cinder-tempest-plugin, python-ironicclient, python-keystonemiddleware, python-monasca-tempest-plugin, python-openstackclient, python-openstacksdk, python-proliantutils, python-python-engineio, python-swiftlm, python-vmware-nsx, python-vmware-nsxlib, yast2-crowbar fixes the following issues:

• Update to version 9.0+git.1566374020.301191f:

  • Use raw image format when using SES backend on Nova (SOC-9285)

• Update to version 9.0+git.1563375514.31fa9a7:

  • Ensure ardana-update-pkgs works for dist-upgrade (SOC-9857)

• Update to version 9.0+git.1563192450.30e8f16:

  • Ensure Cloud8/SLE-12-SP3 repps still served (SOC-9840)

• Update to version 9.0+git.1566251498.be02ca4:

  • adds ipv6 format to http/https urls (SOC-10063)

• Update to version 9.0+git.1565678764.c3a9b9f:

  • adds ipv6 format to urls (SOC-10063)

• Update to version 9.0+git.1562898832.1731f25:

  • FIX broken symlink for policy.yaml.j2. (SOC-0000)

• Update to version 9.0+git.1559333871.40508f7:

  • Allow system to bind to non local ipv6 addresses (SOC-9330)

• Update to version 9.0+git.1566336494.93967dd:

  • Using python netaddr for ipv6 address comparison (SOC-9940)

• Update to version 9.0+git.1564409964.b7e4fc3:

  • Don't use 'latest' with 'zypper' (SOC-9997)

• Update to version 9.0+git.1562182567.aef23e0:

  • Format curl commands for ipv6 (SOC-9369)

• Update to version 9.0+git.1565680593.df7a432:

  • adds ipv6 format to urls (SOC-10063)

• Update to version 9.0+git.1566213657.69862ab:

  • Add missing service plugin for l2gw (SOC-5837)

• Update to version 9.0+git.1563904379.31ff1e9:

  • Add the NSX-T L2-Gateway Service definition (SOC-5837)

• Switch to new Gerrit Server

• Update to version 9.0+git.1566375806.f0b2333:

  • Configure glance image_direct_url/multiple_locations (SOC-9285)

• Update to version 9.0+git.1565720518.c7fdca2:

  • adds ipv6 format to urls (SOC-10063)

• Update to version 9.0+git.1564491141.602fdf9:

  • Default glance_default_store to rbd if SES enabled (SOC-8749)

• Update to version 9.0+git.1565721273.f44b8d7:

  • adds ipv6 format to urls (SOC-10063)

• Update to version 9.0+git.1565891518.2a545a1:

  • adds ipv6 format to urls (SOC-10063)

• Update to version 9.0+git.1565655129.ab3a58c:

  • Removed None condition from rule (SOC-10003)

• Update to version 9.0+git.1564609155.033a963:

  • Updated heat_policy.json permission to be 664 (SOC-9872)

• Update to version 9.0+git.1562848565.91e75b2:

  • Include memcached in the minimal ardana-ci model (SOC-9800)

• Update to version 9.0+git.1566255088.3443670:

  • Add server state column (SOC-9957)

• Update to version 9.0+git.1565218199.868c5d1:

  • Add ipv6 support (SOC-9677) (#357)

• Update to version 9.0+git.1563912815.7090c20:

  • Only show ses config upload option when ses is not configured (SOC-8555)…