RHSA-2017:1508 - Security Advisory

Topic

An update for openstack-nova is now available for Red Hat OpenStack Platform 9.0 (Mitaka).

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

OpenStack Compute (nova) launches and schedules large networks of virtual machines, creating a redundant and scalable cloud computing platform. Compute provides the software, control panels, and APIs required to orchestrate a cloud, including running virtual machine instances and controlling access through users and projects.

The following packages have been upgraded to a later upstream version: openstack-nova (13.1.4). (BZ#1454627, BZ#1454628)

Security Fix(es):

• An information exposure issue was discovered in OpenStack Compute's exception_wrapper.py. Legacy notification exception contexts appearing in ERROR-level logs could include sensitive information such as account passwords and authorization tokens. (CVE-2017-7214)

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat OpenStack 9 x86_64

Fixes

• BZ - 1420877 - libvirt overwrites externally set vlan tags in macvtap passthrough VFs since 2.x so Nova needs to craft the XML to include vlan tag
• BZ - 1421083 - storage migration of instance boot from volume fails with InvalidType
• BZ - 1425316 - `nova rescue` of an instance with Ceph backend fails with corrupted XFS errors
• BZ - 1434844 - CVE-2017-7214 openstack-nova: Sensitive information included in legacy notification exception contexts
• BZ - 1448000 - LibvirtError happens when put instance from pause to active status
• BZ - 1454627 - Rebase openstack-nova to 13.1.3
• BZ - 1454628 - Rebase openstack-nova to 13.1.4

CVEs

• CVE-2017-7214

References

• https://access.redhat.com/security/updates/classification/#moderate