CVE-2018-14432

In the Federation component of OpenStack Keystone before 11.0.4, 12.0.0, and 13.0.0, an authenticated "GET /v3/OS-FEDERATION/projects" request may bypass intended access restrictions on listing projects. An authenticated user may discover projects they have no authority to access, leaking all projects in the deployment and their attributes. Only Keystone with the /v3/OS-FEDERATION endpoint enabled via policy.json is affected.

This update for OpenStack fixes the following issues:

The following security issue with openstack-keystone has been fixed:

• CVE-2018-14432: Reduce duplication in federated authentication APIs. (bsc#1102151)

Additionally, the following non-security issues have been fixed:

openstack-dashboard:

• Fetch and show Cinder availability zones list during volume creation and volume creation from image. (bsc#1100751)

openstack-heat:

• Add Trunk resource support.

openstack-horizon-plugin-designate-ui:

• Install all designate panels that are available.

openstack-nova:

• Stop _undefine_domain erroring if domain not found. (bsc#1099902)
• Fix Nova to allow using cinder v3 endpoint. (bsc#1095482)

python-os-vif:

• Check if interface belongs to a Linux Bridge before removing. (bsc#1084724)

This update for OpenStack fixes the following issues:

The following security issue with openstack-keystone has been fixed:

• CVE-2018-14432: Reduce duplication in federated authentication APIs. (bsc#1102151)

Additionally, the following non-security issues have been fixed:

aodh:

• Support same projects in different domain.

barbican:

• Add zuulv3 to Pike.

cinder:

• Empty option value maybe cause Unity driver failed to initialize.
• GoodnessWeigher schedules non-type volumes.
• Fix quota error when deleting temporary volume.
• Fix cinder quota-usage error.
• Unity: Return logged-out initiators.
• Correct S-Series to DS-Series systems.
• Update storage backends supported for Lenovo.
• Unity: Add support of removing empty host.
• NetApp: Fix to support SVM scoped permissions.
• NetApp ONTAP iSCSI: Force exception on online extend.
• NetApp ONTAP: Set new sub-lun clone limit for ONTAP driver.

dashboard:

• Make @memoize thread-aware.

designate:

• Add provides to handle installation of mdns and producer seamlessly.
• Fix service files.
• Install a default pools.yaml.

glance:

• doc: Modify the description for the command.
• Make ImageTarget behave like a dictionary.
• Add barbican-tempest experimental job.

heat:

• Fixing unicode issue when to_dict is called on py2.7 env.
• Ignore NotFound error in prepare_for_replace.
• Reset resource replaced_by field for rollback.
• Ignore RESOLVE translation errors when translating before_props.
• Ignore errors in purging events.

heat-templates:

• Deprecate hooks in heat-templates.

horizon-plugin-designate-ui:

• Install all designate panels that are available.

horizon-plugin-freezer-ui:

• Avoid using deprecated opt in Web-UI.

horizon-plugin-gbp-ui:

• Fix patching of create instance dialog.

neutron-lbaas-dashboard:

• Remove custom zuul jobs.

horizon-plugin-trove-ui:

• Update UPPER_CONSTRAINTS_FILE for stable/pike.

ironic:

• Fix error when deleting a non-existent port.
• Tear down console during unprovisioning.

manila:

• Fix ZFSOnLinux doc about manage ops.
• DB Migration: Fix downgrade.
• Fix share-service VM restart problem.
• Added Handling Newer Quobyte API Error Codes.
• NetApp ONTAP: Fix delete-share for vsadmin users.
• Remove confusing DB deprecation messages.
• Add missing Requires: for python-tooz

neutron:

• Skip MTU check during deletion of Networks.
• HA L3 agent restart only standby agents.
• Retry dhcp_release on failures.
• Reduce IP address collision during port creating.
• Refactor DVR HA migarations DB operations.
• Disallow router interface out of subnet IP range.
• Fix fwaas v1 configuration doc.
• Add list of all working DSCP marks.
• Set trusted port only once in iptables firewall driver.
• Fix UT BridgeLibTest when IPv6 is disabled.

neutron-fwaas:

• DVR-FWaaS: Fix DVR FWaaS rules for fipnamespace.

neutron-lbaas:

• Get providers directly from ORM to make startup take half as long.
• Cap haproxy log level severity.
• Fix sphinx-docs job for stable branch.

neutron-vpnaas:

• Fix sphinx-docs job for stable branch and pep8 issues.

neutron-zvm-agent:

• Backport zCC backend networking-zvm.

nova:

• libvirt: Add method to configure migration speed.
• Make host_aggregate_map dictionary case-insensitive.
• Fix unbound local when saving an unchanged RequestSpec.
• Cleanup mapping/reqspec after archive instance.
• Default embedded instance.flavor.disabled attribute.
• Backport tox.ini to switch to stestr.
• Cleanup RP and HM records while deleting a compute service.
• Delete allocations from API if nova-compute is down.
• Block deleting compute services which are hosting instances.
• api-ref: Add a note in DELETE /os-services about deleting computes.
• Add functional test for deleting a compute service.
• Factor out compute service start in ServerMovingTest.
• Moving more utils to ProviderUsageBaseTestCase.
• Make nova service-list use scatter-gather routine.
• libvirt: Slow live-migration to ensure network is ready.
• Use instance…