SUSE-SU-2015:1515-1

Dashboard / Vulnerabilities / SUSE-SU-2015:1515-1

SUSE-SU-2015:1515-1

Summary: Security update for openstack and python-oslo.utils

Details: This update provides the following fixes provided from the upstream OpenStack-project: - openstack-suse: + do not copy upstream python requirements to the package, we rely on Requires; upstream requirements.txt introduce version caps which we do not follow (bnc#920573) - openstack-sahara: + Fix getting heat stack in Sahara + Fixed scaling with new node group with auto sg + Open all ports for private network for auto SG + Fix for getting auth url for hadoop-swift + Fixed auto security group cleanup in case of creation error + Add list of open ports for Cloudera plugin + Add missed files for migrations in MANIFEST.in + Include launch_command.py in MANIFEST.in + Fix requires - openstack-keystone: + Updated hybrid backend to include fix for bsc#935892 + Deal with PEP-0476 certificate chaining checking + Backport fixes for v3 API sample policy file (lp#1381809 and lp#1392155). + Install v3 sample policy into the doc directory + Update hybrid backend to include latest fixes for v3 protocol (bsc#928718) + backend_argument should be marked secret + Work with pymongo 3.0 + Speed up memcache lock + Fix up _ldap_res_to_model for ldap identity backend + Don't try to convert LDAP attributes to boolean + Fix the wrong update logic of catalog kvs driver + Do parameter check before updating endpoint_group + Correct initialization order for logging to use eventlet locks + Fix the syntax issue on creating table `endpoint_group` - openstack-heat: + Add env storing for loaded environments + Fix block_device_mapping property validation when using get_attr + Add default_client_name in Nova::FloatingIPAssoc + Fix cloud-init Python syntax for Python < 2.6 + Allow lists and strings for Json parameters via provider resources + RandomString physical_resource_id as id not the string + Authenticate the domain user with id instead of username + Tell stevedore not to force verify requirements + Use properties.data when testing for 'provided by the user' + Ship /usr/lib/heat directory in openstack-heat-engine subpackage, since that's where plugin are loaded from. + Create openstack-heat-plugin-heat_docker subpackage to ship the heat_docker plugin. + Fix update on failed stack + Enable https for keystone while creating stack user + Change the engine-listener topic + Just to delete the stack when adopt rollback + Release stack lock when successfully acquire + Add dependency on Router External Gateway property + Use only FIP dependencies from graph + Add dependency hidden on router_interface + Update heat.conf.sample + Upgrade requirements for kombu and greenlet to Juno versions (bnc#920573) + Stop patching oslo.messaging private bits - openstack-glance: + Eventlet green threads not released back to pool + Replace assert statements with proper control-flow + Fix intermittent unit test failures + Initiate deletion of image files if the import was interrupted to prevent denial of service (bnc#918784, CVE-2014-9684) - openstack-cinder: + Remove nonexistent LIO terminate_connection call + Disallow backing files when uploading volumes to image + LVM: Pass volume size in MiB to copy_volume() during volume migration + Remove iscsi_helper calls from base iscsi driver + Fix exceptions logging in iSCSI targets + Delete the temporary volume if migration fails + Get the 'consumer' in a correct way for retyping with qos-specs + Fix re-export of iscsi volume when using lioadm + Revert 'Add support for customized cluster name' + Failed to discovery when iscsi multipath and CHAP both enabled + Add support for customized cluster name + Only use operational LIFs for iscsi target details + Clear migration_status from a destination volume if migration fails + Deal with PEP-0476 certificate chaining checking - openstack-ceilometer: + Ensure unique list of consumers created + Add bandwidth to measurements + Rely on VM UUID to fetch metrics in libvirt + Retry to connect database when DB2 or mongodb is restarted + Use alarm's evaluation periods in sufficient test + [MongoDB] Fix bug with reconnection to new master node + Fix the value of query_spec.maxSample to advoid to be zero + Fix issue when ceilometer-expirer is called from the wrong user via cronjob and the resulting logs end up having wrong ownership. See also bsc#930574 + Metering data ttl sql backend breaks resource metadata + Stop mocking os.path in test_setup_events_default_config + Move the cron job to collector package (bnc#926596) + Catch exception when evaluate single alarm - python-oslo.utils: + Update to version 1.4.0 * Add a stopwatch + split for duration(s) * Allow providing a logger to save_and_reraise_exception * Utility API to generate EUI-64 IPv6 address * Add a eventlet utils helper module * Add microsecond support to iso8601_from_timestamp * Update Oslo imports to remove namespace package * Add TimeFixture * Add microsecond support to timeutils.utcnow_ts() - python-oslo.i18n: + Update to version 1.3.1 * Remove deprecation warning (bnc#931204) * Correct the translation domain for loading messages * Workflow documentation is now in infra-manual * Imported Translations from Transifex * Activate pep8 check that _ is imported * Make clear in docs to use _LE() when using LOG.exception() * Support building wheels (PEP-427) - python-six: + Update to version 1.9.0 * Support the `flush` parameter to `six.print_`. * Add the `python_2_unicode_compatible` decorator. * Ensure `six.wraps` respects the *updated* and *assigned* arguments. * Fix `six.moves` race condition in multi-threaded code. * Add `six.view(keys|values|itmes)`, which provide dictionary views on Python 2.7+. * Fix add_metaclass when the class has __slots__ containing '__weakref__' or '__dict__'. * Always accept *updated* and *assigned* arguments for wraps(). * Fix import six on Python 3.4 with a custom loader.

References: https://www.suse.com/support/update/announcement/2015/suse-su-20151515-1/, https://bugzilla.suse.com/918784, https://bugzilla.suse.com/920573, https://bugzilla.suse.com/926596, https://bugzilla.suse.com/928718, https://bugzilla.suse.com/930574, https://bugzilla.suse.com/931204, https://bugzilla.suse.com/935892, https://www.suse.com/security/cve/CVE-2014-9684