Publishing details

• Published on 2017-10-11
• Copied from ubuntu trusty in PPA for Ubuntu Security Proposed by Ubuntu Archive Robot

Changelog

nova (1:2014.1.5-0ubuntu1.7) trusty-security; urgency=medium

  * SECURITY UPDATE: DoS via instance deletion during migration
    - debian/patches/CVE-2015-3241-1.patch: check for resize path on
      libvirt instance delete in nova/tests/virt/libvirt/test_libvirt.py,
      nova/virt/libvirt/driver.py.
    - debian/patches/CVE-2015-3241-1.patch: sync process utils from oslo in
      nova/openstack/common/processutils.py.
    - debian/patches/CVE-2015-3241-1.patch: kill rsync/scp processes before
      deleting instance in nova/tests/virt/libvirt/test_libvirt.py,
      nova/tests/virt/libvirt/test_libvirt_utils.py,
      nova/virt/libvirt/driver.py, nova/virt/libvirt/instancejobtracker.py,
      nova/virt/libvirt/utils.py.
    - CVE-2015-3241
  * SECURITY UPDATE: DoS via instance deletion during resize
    - debian/patches/CVE-2015-3280.patch: delete orphaned instance files
      from compute nodes in nova/compute/manager.py,
      nova/tests/compute/test_compute_mgr.py.
    - CVE-2015-3280
  * SECURITY UPDATE: DoS via crafted disk image
    - debian/patches/CVE-2015-5162-1.patch: add prlimit parameter to
      execute() in nova/openstack/common/prlimit.py,
      nova/openstack/common/processutils.py,
      nova/tests/openstack_common/test_processutils.py.
    - debian/patches/CVE-2015-5162-2.patch: add support for missing process
      limits in nova/openstack/common/prlimit.py,
      nova/openstack/common/processutils.py,
      nova/tests/openstack_common/test_processutils.py.
    - debian/patches/CVE-2015-5162-3.patch: set address space & CPU time
      limits when running qemu-img in nova/virt/images.py,
      nova/tests/virt/libvirt/test_libvirt.py,
      nova/tests/virt/libvirt/test_image_utils.py,
      nova/tests/virt/libvirt/test_libvirt_utils.py.
    - CVE-2015-5162
  * SECURITY UPDATE: arbitrary file read via snapshot
    - debian/patches/CVE-2015-7548-1.patch: fix format detection in libvirt
      snapshot in nova/tests/virt/libvirt/fake_libvirt_utils.py,
      nova/tests/virt/libvirt/test_image_utils.py,
      nova/tests/virt/libvirt/test_libvirt_utils.py,
      nova/virt/libvirt/driver.py, nova/virt/libvirt/utils.py.
    - debian/patches/CVE-2015-7548-2.patch: fix format conversion in
      libvirt snapshot in nova/tests/virt/libvirt/test_libvirt.py,
      nova/virt/images.py, nova/virt/libvirt/imagebackend.py.
    - debian/patches/CVE-2015-7548-3.patch: fix backing file detection in
      libvirt live snapshot in nova/tests/virt/libvirt/test_libvirt.py,
      nova/tests/virt/libvirt/fake_libvirt_utils.py, nova/virt/images.py,
      nova/virt/libvirt/driver.py, nova/virt/libvirt/utils.py.
    - debian/patches/CVE-2015-7548-4.patch: disable live snapshot for
      rbd-backed instances in nova/virt/libvirt/driver.py.
    - CVE-2015-7548
  * SECURITY UPDATE: restriction bypass via security group changes
    - debian/patches/CVE-2015-7713.patch: don't expect meta attributes in
      object_compat that aren't in the db obj in nova/compute/manager.py,
      nova/tests/compute/test_compute.py.
    - CVE-2015-7713
  * SECURITY UPDATE: password disclosure via xen log files
    - debian/patches/CVE-2015-8749.patch: mask passwords in volume
      connection_data dict in nova/virt/xenapi/volume_utils.py.
    - CVE-2015-8749
  * SECURITY UPDATE: arbitrary file read via crafted qcow2 header
    - debian/patches/CVE-2016-2140-1.patch: always copy or recreate
      disk.info during a migration in nova/virt/libvirt/driver.py,
      nova/tests/virt/libvirt/test_libvirt.py.
    - debian/patches/CVE-2016-2140-2.patch: fix processing of libvirt
      disk.info in non-disk-image cases in nova/virt/libvirt/driver.py,
      nova/tests/virt/libvirt/test_libvirt.py.
    - debian/patches/CVE-2016-2140-3.patch: decode disk_info before use in
      nova/tests/virt/libvirt/test_libvirt.py, nova/virt/libvirt/driver.py.
    - CVE-2016-2140
  * Thanks to Red Hat for the backports many of these patches are based on.

 -- Marc Deslauriers <email address hidden>  Wed, 13 Sep 2017 14:30:17 -0400

Builds

• i386

Built packages

• nova-ajax-console-proxy OpenStack Compute - AJAX console proxy - transitional package

• nova-api OpenStack Compute - API frontend

• nova-api-ec2 OpenStack Compute - EC2 API frontend

• nova-api-metadata OpenStack Compute - metadata API frontend

• nova-api-os-compute OpenStack Compute - OpenStack Compute API frontend

• nova-api-os-volume OpenStack Compute - OpenStack Volume API frontend

• nova-baremetal Openstack Compute - baremetal virt

• nova-cells Openstack Compute - cells

• nova-cert OpenStack Compute - certificate management

• nova-common OpenStack Compute - common files

• nova-compute OpenStack Compute - compute node base

• nova-compute-kvm OpenStack Compute - compute node (KVM)

• nova-compute-libvirt OpenStack Compute - compute node libvirt support

• nova-compute-lxc OpenStack Compute - compute node (LXC)

• nova-compute-qemu OpenStack Compute - compute node (QEmu)

• nova-compute-vmware OpenStack Compute - compute node (VMware)

• nova-compute-xen OpenStack Compute - compute node (Xen)

• nova-conductor OpenStack Compute - conductor service

• nova-console OpenStack Compute - Console

• nova-consoleauth OpenStack Compute - Console Authenticator

• nova-doc OpenStack Compute - documentation

• nova-network OpenStack Compute - Network manager

• nova-novncproxy OpenStack Compute - NoVNC proxy

• nova-objectstore OpenStack Compute - object store

• nova-scheduler OpenStack Compute - virtual machine scheduler

• nova-spiceproxy OpenStack Compute - spice html5 proxy

• nova-volume OpenStack Compute - storage

• nova-xvpvncproxy OpenStack Compute - XVP VNC proxy

• python-nova OpenStack Compute Python libraries

Package files

• nova-ajax-console-proxy_2014.1.5-0ubuntu1.7_all.deb (2.5 KiB)
• nova-api-ec2_2014.1.5-0ubuntu1.7_all.deb (4.3 KiB)
• nova-api-metadata_2014.1.5-0ubuntu1.7_all.deb (4.5 KiB)
• nova-api-os-compute_2014.1.5-0ubuntu1.7_all.deb (4.2 KiB)
• nova-api-os-volume_2014.1.5-0ubuntu1.7_all.deb (5.3 KiB)
• nova-api_2014.1.5-0ubuntu1.7_all.deb (4.6 KiB)
• nova-baremetal_2014.1.5-0ubuntu1.7_all.deb (3.5 KiB)
• nova-cells_2014.1.5-0ubuntu1.7_all.deb (3.4 KiB)
• nova-cert_2014.1.5-0ubuntu1.7_all.deb (4.3 KiB)
• nova-common_2014.1.5-0ubuntu1.7_all.deb (10.9 KiB)
• nova-compute-kvm_2014.1.5-0ubuntu1.7_all.deb (2.8 KiB)
• nova-compute-libvirt_2014.1.5-0ubuntu1.7_all.deb (2.8 KiB)
• nova-compute-lxc_2014.1.5-0ubuntu1.7_all.deb (2.8 KiB)
• nova-compute-qemu_2014.1.5-0ubuntu1.7_all.deb (2.8 KiB)
• nova-compute-vmware_2014.1.5-0ubuntu1.7_all.deb (2.8 KiB)
• nova-compute-xen_2014.1.5-0ubuntu1.7_all.deb (2.8 KiB)
• nova-compute_2014.1.5-0ubuntu1.7_all.deb (6.9 KiB)
• nova-conductor_2014.1.5-0ubuntu1.7_all.deb (4.3 KiB)
• nova-console_2014.1.5-0ubuntu1.7_all.deb (4.4 KiB)
• nova-consoleauth_2014.1.5-0ubuntu1.7_all.deb (4.4 KiB)
• nova-doc_2014.1.5-0ubuntu1.7_all.deb (1.9 MiB)
• nova-network_2014.1.5-0ubuntu1.7_all.deb (6.3 KiB)
• nova-novncproxy_2014.1.5-0ubuntu1.7_all.deb (4.3 KiB)
• nova-objectstore_2014.1.5-0ubuntu1.7_all.deb (4.5 KiB)
• nova-scheduler_2014.1.5-0ubuntu1.7_all.deb (4.3 KiB)
• nova-spiceproxy_2014.1.5-0ubuntu1.7_all.deb (3.5 KiB)
• nova-volume_2014.1.5-0ubuntu1.7_all.deb (5.5 KiB)
• nova-xvpvncproxy_2014.1.5-0ubuntu1.7_all.deb (4.3 KiB)
• nova_2014.1.5-0ubuntu1.7.debian.tar.gz (92.5 KiB)
• nova_2014.1.5-0ubuntu1.7.dsc (4.5 KiB)
• nova_2014.1.5.orig.tar.gz (7.6 MiB)
• python-nova_2014.1.5-0ubuntu1.7_all.deb (1.8 MiB)