Synopsis

Moderate: openstack-nova security update

Type/Severity

Security Advisory: Moderate

Topic

Updated openstack-nova packages that fix one security issue and several
bugs, and add various enhancements are now available for Red Hat
Enterprise Linux OpenStack Platform 5.0, 6.0, and 7.0

Red Hat Product Security has rated this update as having Moderate security
impact. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available from the CVE link in the
References section.

Description

OpenStack Compute (nova) launches and schedules large networks of virtual
machines, creating a redundant and scalable cloud computing platform.
Compute provides the software, control panels, and APIs required to
orchestrate a cloud, including running virtual machine instances and
controlling access through users and projects.

A denial of service flaw was found in the OpenStack Compute instance
migration process. Because the migration process does not terminate
when an instance is deleted, an authenticated user could bypass
user quota and deplete all available disk space by repeatedly re-sizing
and deleting an instance. (CVE-2015-3241)

A flaw was found in the way OpenStack Compute handled the resize
state. If an authenticated user deleted an instance while it was in the
resize state, it could cause the original instance to not be deleted from
the compute node it was running on, allowing the user to cause a denial
of service. (CVE-2015-3280)

Note: CVE-2015-3241 was already addressed in Red Hat Enterprise Linux
OpenStack Platform 7.0 in a previous release.

Red Hat would like to thank the OpenStack project for reporting these
issues. Upstream acknowledges George Shuklin of Webzilla LTD as the
original reporter of CVE-2015-3241, and George Shuklin from Webzilla LTD
and Tushar Patil from NTT DATA, Inc. as the original reporters of
CVE-2015-3280.

All openstack-nova users are advised to upgrade to these updated packages,
which correct these issues and add these enhancements.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat OpenStack 7 x86_64
• Red Hat OpenStack 6.0 x86_64
• Red Hat OpenStack 5.0 for RHEL 7 x86_64
• Red Hat OpenStack 5.0 for RHEL 6 x86_64

Fixes

• BZ - 1232782 - CVE-2015-3241 openstack-nova: Nova instance migration process does not stop when instance is deleted
• BZ - 1257942 - CVE-2015-3280 openstack-nova: Deleting instances in resize state fails

CVEs

• CVE-2015-3241
• CVE-2015-3280

References

• http://www.redhat.com/security/updates/classification/#normal

Red Hat OpenStack 7

SRPM
openstack-nova-2015.1.1-3.el7ost.src.rpm	SHA-256: d95362f45dcba8d6e8ab12e07d406b014373042c6ba7e299610c7b47b8fea8d3
x86_64
openstack-nova-2015.1.1-3.el7ost.noarch.rpm	SHA-256: 2c02bfe9817bd7e5698e2383857eb268705ea4dec1220ae273c0a9ef9b19b5fb
openstack-nova-api-2015.1.1-3.el7ost.noarch.rpm	SHA-256: 075a84bc783013a9b6d7e733c5557a89fcdb584bef94afc705f229d85758335a
openstack-nova-cells-2015.1.1-3.el7ost.noarch.rpm	SHA-256: f8644452ddaeb0840d694a7afd078e976366861678189d8e5f27663c41eab2bc
openstack-nova-cert-2015.1.1-3.el7ost.noarch.rpm	SHA-256: 342b7818a7a6679ddfcba2a7028db86c78088003f5f22ce7be59c8c852fe3d7b
openstack-nova-common-2015.1.1-3.el7ost.noarch.rpm	SHA-256: bef6c5e05b900de4d724b4e40f383887d8cbc1593dc3aa5eb45927366b2ffe64
openstack-nova-compute-2015.1.1-3.el7ost.noarch.rpm	SHA-256: 9d02d75c2ee9dca7b7e6e35fe859ae944fa3802408acb35827185a4e31cf84d6
openstack-nova-conductor-2015.1.1-3.el7ost.noarch.rpm	SHA-256: 4999d08b92f2d4024f0086ab858444b4f8142f5fba0e1eeca3412196a7eb64bb
openstack-nova-console-2015.1.1-3.el7ost.noarch.rpm	SHA-256: 0a274cf99dc39ccc523f0c3b36b5c10421f906fea571bb50f7e3fce9db5e07a0
openstack-nova-doc-2015.1.1-3.el7ost.noarch.rpm	SHA-256: d8b9d3bde8a9b9829c99ce514d4610fe933989a278d26be286b7e863b736cba3
openstack-nova-network-2015.1.1-3.el7ost.noarch.rpm	SHA-256: ea86b06d54de27a367d01679165a9f6674a377fd5ac18dbdbccde977e2ac837d
openstack-nova-novncproxy-2015.1.1-3.el7ost.noarch.rpm	SHA-256: 8aec4bf6ad169074a0f603794a596b8a79aa91f062a7972230f155825c5142c4
openstack-nova-objectstore-2015.1.1-3.el7ost.noarch.rpm	SHA-256: 598eecb1c4f5161d392de7c424d709b9e1b60928306cabe452dbc1664ddf98ca
openstack-nova-scheduler-2015.1.1-3.el7ost.noarch.rpm	SHA-256: c78437aed2880ef295fff87efdbd2fe52da02337287c503f1e0c4958e7feeccd
openstack-nova-serialproxy-2015.1.1-3.el7ost.noarch.rpm	SHA-256: a27cc6f13b8cbef091d357dcc68afd01fd4e4d7f9d2cca8f8c6e542c0a6369af
openstack-nova-spicehtml5proxy-2015.1.1-3.el7ost.noarch.rpm	SHA-256: b7dde7bf5cbe4c69a66a62eb815fcf6b9bb72f8d269c20d864a889370fd5bfa7
python-nova-2015.1.1-3.el7ost.noarch.rpm	SHA-256: 952bd47c3658a418294778adfc5b2254353d52b0789a117e4070087322be9916

Red Hat OpenStack 6.0

SRPM
openstack-nova-2014.2.3-31.el7ost.src.rpm	SHA-256: 43b5f0354d772b3d764b28a0eb6ae61bb18bfa8a2e44b8c0566812e6526db6cc
x86_64
openstack-nova-2014.2.3-31.el7ost.noarch.rpm	SHA-256: a479fc669974c6feed363cb6b74b9c4ce67bf0cd8aa2841a1b53d8a65aabaae5
openstack-nova-api-2014.2.3-31.el7ost.noarch.rpm	SHA-256: 7aea2bb9a6ddcf20ff1a0da5bc47f9ea13e3bb9e60021c8cdf8183ee8c5e1b6c
openstack-nova-cells-2014.2.3-31.el7ost.noarch.rpm	SHA-256: 88cd9e95e0e2bdbbeffa4bd59700fd3bbdb239f5c690f12b76e658d4e3feec4d
openstack-nova-cert-2014.2.3-31.el7ost.noarch.rpm	SHA-256: 180ab6b51f3688719d6e19fb6f95f9fd375507491aa802b3bc0ada1ff747b2a0
openstack-nova-common-2014.2.3-31.el7ost.noarch.rpm	SHA-256: c8895e21fb5a3cc320b10cadbfab165719fadc73d98b731c0e4e1e0c6e64814f
openstack-nova-compute-2014.2.3-31.el7ost.noarch.rpm	SHA-256: 05a6e8bdd097939b2f7f4339eb22ae042c6a92ed8732c0304f1e9a99bfd2c274
openstack-nova-conductor-2014.2.3-31.el7ost.noarch.rpm	SHA-256: 99da2024c746f3f0533ca14b132b21d3918f23fffbcac9705b0ba7c1457198f7
openstack-nova-console-2014.2.3-31.el7ost.noarch.rpm	SHA-256: b0df40e81d05f9a31a6c322c1d8434b230d9f376a0c4d7cbbc735a74708091d3
openstack-nova-doc-2014.2.3-31.el7ost.noarch.rpm	SHA-256: 607b5e866a676644afc90bf4822ce6f78ac885dfb53b829397e83f02220c90b0
openstack-nova-network-2014.2.3-31.el7ost.noarch.rpm	SHA-256: 0c4d96b0a963eddec1deac112a1b901aea14177088b0df316edbe9b9e409cc71
openstack-nova-novncproxy-2014.2.3-31.el7ost.noarch.rpm	SHA-256: b8efe528b2a2394ecbcf0c1fa7916576a2fe32933ee018a1c03e5a82d8ed6c29
openstack-nova-objectstore-2014.2.3-31.el7ost.noarch.rpm	SHA-256: 381c58d229e1363d08e17874574cd388714e0da0d0f27878602d1d055fe9f8d9
openstack-nova-scheduler-2014.2.3-31.el7ost.noarch.rpm	SHA-256: 5d906ba2c8d72bc25bc68f9253f25f19e767c003597affddbe823c5eb9f93f4c
openstack-nova-serialproxy-2014.2.3-31.el7ost.noarch.rpm	SHA-256: 26236a11bb5bce645d0641300842b0ee29682bafdfbb6e6159a78de70d01901b
python-nova-2014.2.3-31.el7ost.noarch.rpm	SHA-256: 39509e4be0a8c85287a079aa8391ddb73e4bb08593d8da2c1c392889df429fb0

Red Hat OpenStack 5.0 for RHEL 7

SRPM
openstack-nova-2014.1.5-5.el7ost.src.rpm	SHA-256: f76c923e499acaedc355ee69ab534a5762df4f2dded011d003b92d6ba2a786e9
x86_64
openstack-nova-2014.1.5-5.el7ost.noarch.rpm	SHA-256: 2065289e5f3f204b5ba60e04a43f9d5bc79be6645300bebacd692595b6d2d436
openstack-nova-api-2014.1.5-5.el7ost.noarch.rpm	SHA-256: 91f4da0501d24227c8c4b2e9bfbae73765dca2105e04c3bb9aa6bd6b59dd6d1e
openstack-nova-cells-2014.1.5-5.el7ost.noarch.rpm	SHA-256: c3d3ad80375a268cd1e6ae0b6a51424cda97e8c30111732eb0bed9f6da20f3dc
openstack-nova-cert-2014.1.5-5.el7ost.noarch.rpm	SHA-256: 3517e6d5b16b42c0630c9e91d79656c27d3bf78866f98352668dde37d1091e77
openstack-nova-common-2014.1.5-5.el7ost.noarch.rpm	SHA-256: 46d47268df742b154a30ff97c506a1dd7b8ea86df7c302f8c8dca7d9c9faa4b4
openstack-nova-compute-2014.1.5-5.el7ost.noarch.rpm	SHA-256: 01293851fc128c067b3d75325ab4fb137ffd81cd8cb0277dbee8155b4434930b
openstack-nova-conductor-2014.1.5-5.el7ost.noarch.rpm	SHA-256: 70a8a4cf8e07ee3e1e69b939cf1c420822fe6b1e60f96408288a65f3ce7566fe
openstack-nova-console-2014.1.5-5.el7ost.noarch.rpm	SHA-256: 9c0f8a8e0e82a8212d0dae589799493d62348fa868fea9e17415ece190045427
openstack-nova-doc-2014.1.5-5.el7ost.noarch.rpm	SHA-256: 33d4615e4956f4b5d2233624d0c3726fc5304e76619b58ce69554be2bce29632
openstack-nova-network-2014.1.5-5.el7ost.noarch.rpm	SHA-256: 94dd9ed40b22c6b778f4fc3843be2c96e7a212d29cede449d02f3974ecda42e8
openstack-nova-novncproxy-2014.1.5-5.el7ost.noarch.rpm	SHA-256: 3538da754c32c65d221f26fa2ffde49eaeed71fde8b1a12308ebcdc5afd2eb0a
openstack-nova-objectstore-2014.1.5-5.el7ost.noarch.rpm	SHA-256: f8fd60679f7d269328036697b1ecc493d93cac8a1602847110fce02365f9ad31
openstack-nova-scheduler-2014.1.5-5.el7ost.noarch.rpm	SHA-256: 9b561e8fbb7d50202ef420dfacdf4afe6fac48463331deff7ccdb8498bc9c9f6
openstack-nova-serialproxy-2014.1.5-5.el7ost.noarch.rpm	SHA-256: 3ee8f6d73aa049225f9720429f4a27149465414ccb4f7bb03f026430ff3cec3e
python-nova-2014.1.5-5.el7ost.noarch.rpm	SHA-256: 99b0b4f6e0b1037e5f3a3c2699fe35de27dce369c7c4972340a3802f9f34beda

Red Hat OpenStack 5.0 for RHEL 6

SRPM
openstack-nova-2014.1.5-3.el6ost.src.rpm	SHA-256: c8dc03b01dd14f87b81ad4a9a671aac09c1e61a8df07b64b6d5ca38657ad2832
x86_64
openstack-nova-2014.1.5-3.el6ost.noarch.rpm	SHA-256: 65db13253981b6b99d8ac0c3092f1712115d445754a3221464e45b3a6c8c1e36
openstack-nova-api-2014.1.5-3.el6ost.noarch.rpm	SHA-256: c0b0d55e43f616a24bcc9bc66411751fff012919f5d12d3c5e8f1396760bbe2f
openstack-nova-cells-2014.1.5-3.el6ost.noarch.rpm	SHA-256: 4d97f5056d93c363ea89dce1d3e6394532683b81b05bb31908459339f30bc90d
openstack-nova-cert-2014.1.5-3.el6ost.noarch.rpm	SHA-256: 93860fc4e2d36d2de21c523ff5e13fb522e64851713d0e405f77052720fe92f8
openstack-nova-common-2014.1.5-3.el6ost.noarch.rpm	SHA-256: 3215cd4ba34253a742cf3d7aefcbaa8a4444d614460f804a428a1b96d2a660d3
openstack-nova-compute-2014.1.5-3.el6ost.noarch.rpm	SHA-256: 088e5abf2213858a12830381e75b9f959503f76d822cffbdbba2cfd86feeec1e
openstack-nova-conductor-2014.1.5-3.el6ost.noarch.rpm	SHA-256: ff18787313624b264f2fb9fc2cd6adbab2c956bd9dddd7d8dbddf14f6c28044a
openstack-nova-console-2014.1.5-3.el6ost.noarch.rpm	SHA-256: 9b335abae0c771696770a560eacf85fd8afa1dd4df20cfce4ae8e1a44a9f4124
openstack-nova-doc-2014.1.5-3.el6ost.noarch.rpm	SHA-256: 7b200d6282a2a36d8dbc28655533d46ef6175778bfbf2174bc1f95e5232eac93
openstack-nova-network-2014.1.5-3.el6ost.noarch.rpm	SHA-256: efa3009f57b77951aac608254c1b35bc2d06b9ebf6496c7cf9cfb3aba31a0b24
openstack-nova-novncproxy-2014.1.5-3.el6ost.noarch.rpm	SHA-256: e4303aa4d97507599bf6468b21b37a41b1a592f781641aeace9437d1e6faf772
openstack-nova-objectstore-2014.1.5-3.el6ost.noarch.rpm	SHA-256: 54a87e64f6fd3afed9105ec234baaac31c5be518e6c562d579a3df6a5bd10b6d
openstack-nova-scheduler-2014.1.5-3.el6ost.noarch.rpm	SHA-256: c5dac0cb4d2eee5e94478886b4b4f26697894b78d0f3220cb0804a9c5aac1dd2
openstack-nova-serialproxy-2014.1.5-3.el6ost.noarch.rpm	SHA-256: d41e7588ea83c0f2f3f2a4e15904582f6d0b40b01cf135f289929ddf9ad00716
python-nova-2014.1.5-3.el6ost.noarch.rpm	SHA-256: 55b8d7a8b1e40d68db2a4c1537a572037b9fbd221576ad64dbd242d32baee551