CVE-2015-0259

OpenStack Compute (Nova) before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket requests, which allows remote attackers to hijack the authentication of users for access to consoles via a crafted webpage.

OpenStack Compute (Nova) before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket requests, which allows remote attackers to hijack the authentication of users for access to consoles via a crafted webpage.

This update provides fixes and enhancements for various Crowbar barclamps and OpenStack components.

crowbar-barclamp-ceilometer:

• Do not assume ceilometer-agent-hyperv is listed in elements. (bsc#937117)

crowbar-barclamp-cinder:

• Fix hideShow toggle of password_field in backends. (bsc#919963)

crowbar-barclamp-neutron:

• Set dhcp_agents_per_network option. (bsc#928189)
• Set dhcp_agents_per_network only in HA mode. (bsc#934651)
• Allocate SDN IP for NSX nodes. (bsc#934688)
• Pass keystone admin password to neutron-ha-tool via file. (bsc#922751)
• Use lower MTU value for GRE+VXLAN tunnels. (bsc#917328)
• Allow Nova to work with ssl-keystone. (bsc#895594)

crowbar-barclamp-nova:

• Add support for Docker as tech preview. (fate#317913)
• Enable the 2.1 API. (bsc#934225)
• Fix parsing of 'virsh secret-list' header. (bsc#931284)
• Allow neutron+glance+cinder to work with ssl-keystone. (bsc#895594)

openstack-neutron:

• Change neutron-ha-tool to read password from /etc/neutron/os_password. (bsc#922751)
• Allow images with existing routes in the network 169.254.0.0/16 to access metadata server. (bnc#915245)

openstack-nova:

• Backport of the NUMA checks from the master branch. (bsc#931043)
• Fix metadata not returning just instance private IP. (bsc#934523)
• Enable tenant/user specific instance filtering. (bsc#927625)
• Cleanup allocated networks after rescheduling. (bsc#931839)
• Websocket Proxy should verify Origin header to prevent Cross-Site WebSocket hijacking. (bsc#917091, CVE-2015-0259)

The packages crowbar-barclamp-keystone, crowbar-barclamp-hyperv and openstack-resource-agents also received bug fixes and enhancements. For a comprehensive list of changes please refer to each package's change log.

This collective update for the Cloud Compute 12 Module provides several fixes and enhancements.

openstack-suse:

• Do not copy upstream Python requirements to the package. (bsc#920573)

openstack-nova:

• Fix metadata not returning just instance private IP. (bsc#934523)
• Enable tenant/user specific instance filtering. (bsc#927625)
• Cleanup allocated networks after rescheduling. (bsc#931839)
• Fix instance filtering. (bsc#927625)
• Websocket Proxy should verify Origin header to prevent Cross-Site WebSocket hijacking. (bsc#917091, CVE-2015-0259)

openstack-neutron:

• Change neutron-ha-tool to read password from /etc/neutron/os_password. (bsc#922751)
• Change port status when it is bound. (bsc#926773)
• Require conntrack-tools for SLE12. (bsc#944339)
• Allow images with existing routes in the network 169.254.0.0/16 to access metadata server. (bsc#915245)

openstack-ceilometer:

• Fix issue when ceilometer-expirer is called from the wrong user via cronjob and the resulting logs end up having wrong ownership. (bsc#930574)
• Move the cron job to collector package. (bsc#926596)

For a comprehensive list of changes, please refer to the packages' change log.

OpenStack Compute (Nova) before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket requests, which allows remote attackers to hijack the authentication of users for access to consoles via a crafted webpage.