Synopsis

Moderate: openstack-nova security and bug fix update

Type/Severity

Security Advisory: Moderate

Topic

An update for openstack-nova is now available for Red Hat OpenStack Platform 12.0 (Pike).

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

OpenStack Compute (nova) launches and schedules large networks of virtual machines, creating a redundant and scalable cloud computing platform. Compute provides the software, control panels, and APIs required to orchestrate a cloud, including running virtual machine instances and controlling access through users and projects.

Security Fix(es):

• By rebuilding an instance using a new image, an authenticated user may be able to circumvent the Filter Scheduler, bypassing imposed filters (for example, the ImagePropertiesFilter or the IsolatedHostsFilter). (CVE-2017-16239)
  

Red Hat would like to thank the OpenStack project for reporting this issue. Upstream acknowledges George Shuklin (Servers.com) as the original reporter.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat OpenStack 12 x86_64
• Red Hat OpenStack for IBM Power 12 ppc64le

Fixes

• BZ - 1508539 - CVE-2017-16239 openstack-nova: Nova Filter Scheduler bypass through rebuild action
• BZ - 1518879 - Cannot boot vm with sriov port after upgrade OSP11 to OSP12
• BZ - 1527644 - Unable to resize nova instance after upgrade to OSP 10
• BZ - 1533161 - migration with block migration fails as disk_available_least is negative

CVEs

• CVE-2017-16239

References

• https://access.redhat.com/security/updates/classification/#moderate

Red Hat OpenStack 12

SRPM
openstack-nova-16.0.2-9.el7ost.src.rpm	SHA-256: c87c3e269d702023ba930c39e0835f6fde48f43292a30563d298e6b06257427e
x86_64
openstack-nova-16.0.2-9.el7ost.noarch.rpm	SHA-256: daacfcc3dd2c1024afd3cf8b3b20cd070fe75abb3f49b2e3fc8c9d06360d5dca
openstack-nova-api-16.0.2-9.el7ost.noarch.rpm	SHA-256: 615eefe73c4c8f4d89dea5f1d15788cf61bd8abeab74416aaba9e73dca08b3f9
openstack-nova-cells-16.0.2-9.el7ost.noarch.rpm	SHA-256: e1a4617c68069b130fa4c478fbc371aacf9542317db11941fa9b3c2b16c5f110
openstack-nova-common-16.0.2-9.el7ost.noarch.rpm	SHA-256: 020cb069027c01705f9b5a0a60eb0f5c57cf11f0eb7d1345251f7949defb0c6b
openstack-nova-compute-16.0.2-9.el7ost.noarch.rpm	SHA-256: 47735a3d32ab2b3b9c30e0c648ae8d7320a2f0320bcb1295a94d7eb4fb56ac47
openstack-nova-conductor-16.0.2-9.el7ost.noarch.rpm	SHA-256: 1dcfe968ea0844ece7be1e11e816aedccb12225fb5c53483d196980c3fbd159f
openstack-nova-console-16.0.2-9.el7ost.noarch.rpm	SHA-256: 773060497b45ef620d9ee79be1ca900f85b6d3a98141ee437f4a20e83f5fd000
openstack-nova-migration-16.0.2-9.el7ost.noarch.rpm	SHA-256: 7d2a0a7af67c0b032d45f96596be64e23623becf97ecccd3dcb5a959840357f6
openstack-nova-network-16.0.2-9.el7ost.noarch.rpm	SHA-256: 37f5adc888d57c26a0a0f9ec320e211d93666b490f5875e9ed427dea8bac9e67
openstack-nova-novncproxy-16.0.2-9.el7ost.noarch.rpm	SHA-256: 0511dead6dcadbc08fc83083dcc4522c5cb8690cd0f6c17fb6abdb33d1bc3409
openstack-nova-placement-api-16.0.2-9.el7ost.noarch.rpm	SHA-256: 6936b1a0ab6018d4f5685fa3ecb69856f8bce7cc5584f83fbd52b3d6ab0b7f32
openstack-nova-scheduler-16.0.2-9.el7ost.noarch.rpm	SHA-256: bbd5263cf9447d3aacd4d9f12525c700dcb45db3ed876401fafdd33a8ed8d1c8
openstack-nova-serialproxy-16.0.2-9.el7ost.noarch.rpm	SHA-256: da32793fabad82e0779abba78593672d591bb42ac3fa2f795abf8074b0efa02e
openstack-nova-spicehtml5proxy-16.0.2-9.el7ost.noarch.rpm	SHA-256: d508e502755af11e4611228e2acbe796e1867b38f1bdcb5328b8d47d84dec9c7
python-nova-16.0.2-9.el7ost.noarch.rpm	SHA-256: 08dbb41b67b436074cd9883ee84a62b3d9a8bf1602205c242a69b3ca85073e48
python-nova-tests-16.0.2-9.el7ost.noarch.rpm	SHA-256: 13c5dcd817b49c249a7b738c756067f983e17f3913087b329582131746361a67

Red Hat OpenStack for IBM Power 12

SRPM
openstack-nova-16.0.2-9.el7ost.src.rpm	SHA-256: c87c3e269d702023ba930c39e0835f6fde48f43292a30563d298e6b06257427e
ppc64le
openstack-nova-16.0.2-9.el7ost.noarch.rpm	SHA-256: daacfcc3dd2c1024afd3cf8b3b20cd070fe75abb3f49b2e3fc8c9d06360d5dca
openstack-nova-api-16.0.2-9.el7ost.noarch.rpm	SHA-256: 615eefe73c4c8f4d89dea5f1d15788cf61bd8abeab74416aaba9e73dca08b3f9
openstack-nova-cells-16.0.2-9.el7ost.noarch.rpm	SHA-256: e1a4617c68069b130fa4c478fbc371aacf9542317db11941fa9b3c2b16c5f110
openstack-nova-common-16.0.2-9.el7ost.noarch.rpm	SHA-256: 020cb069027c01705f9b5a0a60eb0f5c57cf11f0eb7d1345251f7949defb0c6b
openstack-nova-compute-16.0.2-9.el7ost.noarch.rpm	SHA-256: 47735a3d32ab2b3b9c30e0c648ae8d7320a2f0320bcb1295a94d7eb4fb56ac47
openstack-nova-conductor-16.0.2-9.el7ost.noarch.rpm	SHA-256: 1dcfe968ea0844ece7be1e11e816aedccb12225fb5c53483d196980c3fbd159f
openstack-nova-console-16.0.2-9.el7ost.noarch.rpm	SHA-256: 773060497b45ef620d9ee79be1ca900f85b6d3a98141ee437f4a20e83f5fd000
openstack-nova-migration-16.0.2-9.el7ost.noarch.rpm	SHA-256: 7d2a0a7af67c0b032d45f96596be64e23623becf97ecccd3dcb5a959840357f6
openstack-nova-network-16.0.2-9.el7ost.noarch.rpm	SHA-256: 37f5adc888d57c26a0a0f9ec320e211d93666b490f5875e9ed427dea8bac9e67
openstack-nova-novncproxy-16.0.2-9.el7ost.noarch.rpm	SHA-256: 0511dead6dcadbc08fc83083dcc4522c5cb8690cd0f6c17fb6abdb33d1bc3409
openstack-nova-placement-api-16.0.2-9.el7ost.noarch.rpm	SHA-256: 6936b1a0ab6018d4f5685fa3ecb69856f8bce7cc5584f83fbd52b3d6ab0b7f32
openstack-nova-scheduler-16.0.2-9.el7ost.noarch.rpm	SHA-256: bbd5263cf9447d3aacd4d9f12525c700dcb45db3ed876401fafdd33a8ed8d1c8
openstack-nova-serialproxy-16.0.2-9.el7ost.noarch.rpm	SHA-256: da32793fabad82e0779abba78593672d591bb42ac3fa2f795abf8074b0efa02e
openstack-nova-spicehtml5proxy-16.0.2-9.el7ost.noarch.rpm	SHA-256: d508e502755af11e4611228e2acbe796e1867b38f1bdcb5328b8d47d84dec9c7
python-nova-16.0.2-9.el7ost.noarch.rpm	SHA-256: 08dbb41b67b436074cd9883ee84a62b3d9a8bf1602205c242a69b3ca85073e48
python-nova-tests-16.0.2-9.el7ost.noarch.rpm	SHA-256: 13c5dcd817b49c249a7b738c756067f983e17f3913087b329582131746361a67