[Bug 2042744] Re: su -s /bin/sh -c "keystone-manage db_sync" keystone
When switching a bug's type from Public to Public Security, please clarify what about it leads you to suspect it represents an exploitable vulnerability. I'm switching it back to a regular Public bug in the meantime. If this was triggered by the earlier mention of a use-after-free condition, it didn't seem to imply that the underlying bug was inside keystone, but maybe should be filed against the eventlet project instead. ** Information type changed from Public Security to Public -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2042744 Title: su -s /bin/sh -c "keystone-manage db_sync" keystone To manage notifications about this bug go to: https://bugs.launchpad.net/keystone/+bug/2042744/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1452641] Re: Static Ceph mon IP addresses in connection_info can prevent VM startup
Please don't set OpenStack bugs to Public Security without some explanation as to why you believe this to be an exploitable risk which needs attention from the OpenStack vulnerability managers for coordinating a possible security advisory. I'm switching this back to a normal Public bug for now, but if you suspect this report represents an actual security risk then please explain and set it to Public Security again. Thanks! ** Information type changed from Public Security to Public -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1452641 Title: Static Ceph mon IP addresses in connection_info can prevent VM startup To manage notifications about this bug go to: https://bugs.launchpad.net/nova/+bug/1452641/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1939733] Re: [OSSA-2021-005] Arbitrary dnsmasq reconfiguration via extra_dhcp_opts (CVE-2021-40085)
Slawek is one of the upstream Neutron developers. One of the Ubuntu package maintainers will need to take care of Ubuntu's package updates. It's probably mildly confusing that this bug report is marked as affecting the upstream project (where it's been fixed for months) but also the Ubuntu packages which still need the report triaged. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1939733 Title: [OSSA-2021-005] Arbitrary dnsmasq reconfiguration via extra_dhcp_opts (CVE-2021-40085) To manage notifications about this bug go to: https://bugs.launchpad.net/cloud-archive/+bug/1939733/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1940450] Re: XSS The data-template attribute of the tooltip and popover plugins lacks input sanitization and may allow attacker to execute arbitrary JavaScript.
I too am entirely out of my comfort zone with Javascript, so my level of certainty is low, based solely on the text of CVE-2019-8331 which says (all?) Bootstrap versions prior to 3.4.1 are affected. I also did not check the rdepends for python3-xstatic-bootstrap-scss in Ubuntu and perhaps incorrectly assumed it might be used by more packages or by unpackaged software on people's systems. I'll continue trying to get one of the Horizon developers to provide input on this report... I am but a humble vulnerability coordinator in this particular case, far from being a subject matter expert on the software. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1940450 Title: XSS The data-template attribute of the tooltip and popover plugins lacks input sanitization and may allow attacker to execute arbitrary JavaScript. To manage notifications about this bug go to: https://bugs.launchpad.net/cloud-archive/+bug/1940450/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1855080] Re: [OSSA-2019-006] Credentials API allows listing and retrieving of all users credentials (CVE-2019-19687)
** Summary changed: - Credentials API allows listing and retrieving of all users credentials + [OSSA-2019-006] Credentials API allows listing and retrieving of all users credentials (CVE-2019-19687) -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1855080 Title: [OSSA-2019-006] Credentials API allows listing and retrieving of all users credentials (CVE-2019-19687) To manage notifications about this bug go to: https://bugs.launchpad.net/keystone/+bug/1855080/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1613423] Re: Mitaka + Trusty (kernel 3.13) not using apparmor capability by default, when it does, live migration doesn't work (/tmp/memfd-XXX can't be created)
** Description changed:
- This issue is being treated as a potential security risk under embargo.
- Please do not make any public mention of embargoed (private) security
- vulnerabilities before their coordinated publication by the OpenStack
- Vulnerability Management Team in the form of an official OpenStack
- Security Advisory. This includes discussion of the bug or associated
- fixes in public forums such as mailing lists, code review systems and
- bug trackers. Please also avoid private disclosure to other individuals
- not already approved for access to this information, and provide this
- same reminder to those who are made aware of the issue prior to
- publication. All discussion should remain confined to this private bug
- report, and any proposed fixes should be added to the bug as
- attachments.
-
-
-
- In my environment: Trusty (3.13) + JuJu (1.25) w/ latest charms + Kilo
upgraded to Mitaka (already using non-tunnelled live migrations, after latest
SRU to disable tunnelled live migrations)
+ In my environment: Trusty (3.13) + JuJu (1.25) w/ latest charms + Kilo
+ upgraded to Mitaka (already using non-tunnelled live migrations, after
+ latest SRU to disable tunnelled live migrations)
BUG #1
My compute nodes are NOT loading "apparmor" libvirt capability by
default:
inaddy@tkcompute01:~$ virsh capabilities | grep apparmor | echo $?
1
inaddy@tkcompute02:~$ virsh capabilities | grep apparmor | echo $?
1
inaddy@tkcompute03:~$ virsh capabilities | grep apparmor | echo $?
1
Because "libvirt" is loaded before apparmor profile is loaded and
qemu.conf doesn't specify 'security_driver = "apparmor' in its file. If
you try to add the security driver to the file, libvirt and nova-compute
won't start because apparmor isn't started when they start. For trusty,
apparmor is started as a legacy SYS-V init script, at the end of
initialisation, causing this problem.
After re-starting libvirt-bin service, apparmor starts being used:
inaddy@tkcompute01:~$ sudo service libvirt-bin restart
libvirt-bin stop/waiting
libvirt-bin start/running, process 7031
inaddy@tkcompute01:~$ virsh capabilities | grep apparmor | echo $?
0
inaddy@tkcompute02:~$ sudo service libvirt-bin restart
libvirt-bin stop/waiting
libvirt-bin start/running, process 7031
inaddy@tkcompute02:~$ virsh capabilities | grep apparmor | echo $?
0
inaddy@tkcompute03:~$ sudo service libvirt-bin restart
libvirt-bin stop/waiting
libvirt-bin start/running, process 7031
inaddy@tkcompute03:~$ virsh capabilities | grep apparmor | echo $?
0
BUG #2 (after fixing BUG #1)
And, when libvirt starts using apparmor, and creating apparmor profiles
for every virtual machine created in the compute nodes, mitaka qemu
(2.5) uses a fallback mechanism for creating shared memory for live-
migrations. This fall back mechanism, on kernels 3.13 - that don't have
memfd_create() system-call, try to create files on /tmp/ directory and
fails.. causing live-migration not to work.
Trusty with kernel 3.13 + Mitaka with qemu 2.5 + apparmor capability =
can't live migrate.
From qemu 2.5, logic is on :
void *qemu_memfd_alloc(const char *name, size_t size, unsigned int seals, int
*fd)
{
if (memfd_create)... ### only works with HWE kernels
else ### 3.13 kernels, gets blocked by apparmor
tmpdir = g_get_tmp_dir
...
mfd = mkstemp(fname)
}
And you can see the errors:
From the host trying to send the virtual machine:
2016-08-15 16:36:26.160 1974 ERROR nova.virt.libvirt.driver
[req-0cac612b-8d53-4610-b773-d07ad6bacb91 691a581cfa7046278380ce82b1c38ddd
133ebc3585c041aebaead8c062cd6511 - - -] [instance:
2afa1131-bc8c-43d2-9c4a-962c1bf7723e] Migration operation has aborted
2016-08-15 16:36:26.248 1974 ERROR nova.virt.libvirt.driver
[req-0cac612b-8d53-4610-b773-d07ad6bacb91 691a581cfa7046278380ce82b1c38ddd
133ebc3585c041aebaead8c062cd6511 - - -] [instance:
2afa1131-bc8c-43d2-9c4a-962c1bf7723e] Live Migration failure: internal error:
unable to execute QEMU command 'migrate': Migration disabled: failed to
allocate shared memory
From the host trying to receive the virtual machine:
Aug 15 16:36:19 tkcompute01 kernel: [ 1194.356794] type=1400
audit(1471289779.791:72): apparmor="STATUS" operation="profile_load"
profile="unconfined" name="libvirt-2afa1131-bc8c-43d2-9c4a-962c1bf7723e"
pid=12565 comm="apparmor_parser"
Aug 15 16:36:19 tkcompute01 kernel: [ 1194.357048] type=1400
audit(1471289779.791:73): apparmor="STATUS" operation="profile_load"
profile="unconfined" name="qemu_bridge_helper" pid=12565 comm="apparmor_parser"
Aug 15 16:36:20 tkcompute01 kernel: [ 1194.877027] type=1400
audit(1471289780.311:74): apparmor="STATUS" operation="profile_replace"
profile="unconfined" name="libvirt-2afa1131-bc8c-43d2-9c4a-962c1bf7723e"
pid=12613 comm="apparmor_parser"
Aug 15 16:36:20
[Bug 1533724] Re: [SRU] keystone-signing folders fill /tmp and seriously slow down reboots
** Information type changed from Private to Public -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1533724 Title: [SRU] keystone-signing folders fill /tmp and seriously slow down reboots To manage notifications about this bug go to: https://bugs.launchpad.net/cloud-archive/+bug/1533724/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1855080] Re: Credentials API allows listing and retrieving of all users credentials
Just to get confirmation, this bug was only introduced as of Stein, right? It's not present in Rocky or earlier? Gage, assuming the above is true, and if nobody has any other concerns about your proposed impact description in comment #17, you can probably go ahead and request a CVE assignment for this so we can proceed with the advisory, since the fix has already merged to master and it looks like stable backports are in the process of getting proposed. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1855080 Title: Credentials API allows listing and retrieving of all users credentials To manage notifications about this bug go to: https://bugs.launchpad.net/keystone/+bug/1855080/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1855080] Re: Credentials API allows listing and retrieving of all users' credentials
Somewhat of a grammar nit on the updated title, but it would be "every user's" or "all users'" (placement of the apostrophe in possessive nouns is significant for indicating plurality, and "every" modifies a singular noun as opposed to "all" which modifies a plural). This nuance in the English language is why I suggested dodging "users'" or "user's" and picking different, less ambiguous phrasing so as to avoid confusion for non-native readers of English when skimming the advisory title. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1855080 Title: Credentials API allows listing and retrieving of all users' credentials To manage notifications about this bug go to: https://bugs.launchpad.net/keystone/+bug/1855080/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1855080] Re: Credentials API allows listing and retrieving of all user's credentials
Daniel, is there any organization you want credited along with you for reporting this defect? Gage, I think the use of "user's" in the title (copied from the report itself) incorrectly suggests that a user only has access to credentials for their own user rather than, as the description explains, for all users in that project. Instead maybe try "Credentials API allows listing and retrieving of project credentials" or something like that? As for the affects line, assuming this problem was only introduced in Stein, you want "==15.0.0, ==16.0.0" (wow, were there really no stable/stein point releases?!?) or alternatively ">=15.0.0 <15.0.1, >=16.0.0 <16.0.1" to accurately reflect that any point releases will contain the fix. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1855080 Title: Credentials API allows listing and retrieving of all user's credentials To manage notifications about this bug go to: https://bugs.launchpad.net/keystone/+bug/1855080/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1855080] Re: Credentials API allows listing and retrieving of all user's credentials
The OpenStack VMT will request a CVE assignment from MITRE once we agree on a complete impact description for this report. If you're interested in the details of our report handling processes, you can find them here: https://security.openstack.org/vmt-process.html#process ** Description changed: - This issue is being treated as a potential security risk under embargo. - Please do not make any public mention of embargoed (private) security - vulnerabilities before their coordinated publication by the OpenStack - Vulnerability Management Team in the form of an official OpenStack - Security Advisory. This includes discussion of the bug or associated - fixes in public forums such as mailing lists, code review systems and - bug trackers. Please also avoid private disclosure to other individuals - not already approved for access to this information, and provide this - same reminder to those who are made aware of the issue prior to - publication. All discussion should remain confined to this private bug - report, and any proposed fixes should be added to the bug as - attachments. - Tested against Stein and Train. # User creating a credential, i.e totp or similar $ OS_CLOUD=1 openstack token issue | project_id | c3caf1b55bb84b78a795fd81838e5160 | user_id| 9971b0f13d2d4a578212d028a53c3209 $ OS_CLOUD=1 openstack credential create --type test 9971b0f13d2d4a578212d028a53c3209 test-data $ OS_CLOUD=1 openstack credential list +--+--+--+---++ | ID | Type | User ID | Data | Project ID | +--+--+--+---++ | 0a3a2d3b7dad4886b0bbf61b6cd7d2b0 | test | 9971b0f13d2d4a578212d028a53c3209 | test-data | None | +--+--+--+---++ # Different User but same Project $ OS_CLOUD=2 openstack token issue | project_id | c3caf1b55bb84b78a795fd81838e5160 | user_id| 6b28a0b073fc4ac7843f33190ebc5c3c $ OS_CLOUD=2 openstack credential list +--+--+--+---++ | ID | Type | User ID | Data | Project ID | +--+--+--+---++ | 0a3a2d3b7dad4886b0bbf61b6cd7d2b0 | test | 9971b0f13d2d4a578212d028a53c3209 | test-data | None | +--+--+--+---++ # Different User and Different Project $ OS_CLOUD=3 openstack token issue | project_id | d43f20ae5a7e4f36b701710277384401 | user_id| 2e48f1a7d1474391a826a2b9700e5949 $ OS_CLOUD=3 openstack credential list +--+--+--+---++ | ID | Type | User ID | Data | Project ID | +--+--+--+---++ | 0a3a2d3b7dad4886b0bbf61b6cd7d2b0 | test | 9971b0f13d2d4a578212d028a53c3209 | test-data | None | +--+--+--+---++ As shown anyone who's authenticated can retrieve any credentials including their 'secret'. This is a rather severe information disclosure vulnerability and completely defies the purpose of TOTP or MFA as these credentials are not kept secure or private whatsoever. If Auth-rules are configured allow login with only 'topt' it would be extremely easy to assume a different user's identity. A CVE should be issued for this. I can take care of that paperwork. Versions affected and tested: Train/ubuntu: $ dpkg -l | grep keystone ii keystone 2:16.0.0-0ubuntu1~cloud0 all OpenStack identity service - Daemons ii keystone-common 2:16.0.0-0ubuntu1~cloud0 all OpenStack identity service - Common files ii python-keystoneauth1 3.13.1-0ubuntu1~cloud0 all authentication library for OpenStack Identity - Python 2.7 ii python-keystoneclient1:3.19.0-0ubuntu1~cloud0 all client library for the OpenStack Keystone API - Python 2.x ii python-keystonemiddleware6.0.0-0ubuntu1~cloud0 all Middleware for OpenStack Identity (Keystone) - Python 2.x ii python3-keystone 2:16.0.0-0ubuntu1~cloud0
[Bug 1818239] Re: scheduler: build failure high negative weighting
Since this has come up again in bug 1581977 as representing a security- related concern, I'm adding the security bugtag to it for increased visibility. Note this is not the same as treating it as a security vulnerability, and I don't have the impression that any CVE assignment or security advisory is warranted for this. ** Information type changed from Public Security to Public ** Also affects: ossa Importance: Undecided Status: New ** Changed in: ossa Status: New => Won't Fix ** Tags added: security -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1818239 Title: scheduler: build failure high negative weighting To manage notifications about this bug go to: https://bugs.launchpad.net/charm-nova-cloud-controller/+bug/1818239/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1813007] Re: [SRU] Unable to install new flows on compute nodes when having broken security group rules (CVE-2019-10876)
** Changed in: ossa Status: Confirmed => Fix Released ** Summary changed: - [SRU] Unable to install new flows on compute nodes when having broken security group rules (CVE-2019-10876) + [SRU] [OSSA-2019-002] Unable to install new flows on compute nodes when having broken security group rules (CVE-2019-10876) -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1813007 Title: [SRU] [OSSA-2019-002] Unable to install new flows on compute nodes when having broken security group rules (CVE-2019-10876) To manage notifications about this bug go to: https://bugs.launchpad.net/cloud-archive/+bug/1813007/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1813007] Re: [SRU] Unable to install new flows on compute nodes when having broken security group rules
In that case, as we expect stable/ocata is unaffected, the affects line should be revised as follows: Affects: >=11.0.0 <11.0.7, >=12.0.0 <12.0.6, >=13.0.0 <13.0.3 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1813007 Title: [SRU] Unable to install new flows on compute nodes when having broken security group rules To manage notifications about this bug go to: https://bugs.launchpad.net/cloud-archive/+bug/1813007/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1813007] Re: [SRU] Unable to install new flows on compute nodes when having broken security group rules
Thanks Gage, your proposed impact description in comment #43 looks great (modulo decisions on any stable/ocata backport altering the "affects" line). ** Changed in: ossa Status: Incomplete => Confirmed ** Changed in: ossa Assignee: (unassigned) => Gage Hugo (gagehugo) ** Changed in: ossa Importance: Undecided => Critical -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1813007 Title: [SRU] Unable to install new flows on compute nodes when having broken security group rules To manage notifications about this bug go to: https://bugs.launchpad.net/cloud-archive/+bug/1813007/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1813007] Re: [SRU] Unable to install new flows on compute nodes when having broken security group rules
I see backports to pike, queens, rocky and the stein release candidate branches have been proposed according to https://review.openstack.org/#/q/I17ab643abbd2ec21eda4ae1dfb9abf2d4b0657f2 and have been positively scored by some stable branch reviewers, so I'm going to take that as a sign the solution is acceptably backportable. I'll draft an impact description in a forthcoming bug comment to solicit further feedback. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1813007 Title: [SRU] Unable to install new flows on compute nodes when having broken security group rules To manage notifications about this bug go to: https://bugs.launchpad.net/cloud-archive/+bug/1813007/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1813007] Re: [SRU] Unable to install new flows on compute nodes when having broken security group rules
Thanks for the heads up, Joshua! The OpenStack VMT is, in turn, waiting for the reporter, Neutron reviewers or, well, anybody really to clarify the impact of this bug and indicate whether a fix will be implemented in stable branches (per my comment #35). -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1813007 Title: [SRU] Unable to install new flows on compute nodes when having broken security group rules To manage notifications about this bug go to: https://bugs.launchpad.net/cloud-archive/+bug/1813007/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1813007] Re: [SRU] Unable to install new flows on compute nodes when having broken security group rules
Is there a chance anyone's working on backporting I17ab643abbd2ec21eda4ae1dfb9abf2d4b0657f2 upstream to stable/pike through stable/rocky? Is the impact roughly similar in nature to https://security.openstack.org/ossa/OSSA-2019-001.html or can someone make an attempt at describing a viable exploit scenario so we can draft an appropriate impact description? ** Tags added: pike-backport-potential queens-backport-potential rocky- backport-potential -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1813007 Title: [SRU] Unable to install new flows on compute nodes when having broken security group rules To manage notifications about this bug go to: https://bugs.launchpad.net/cloud-archive/+bug/1813007/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1818239] Re: scheduler: build failure high negative weighting
Chris: I don't doubt that this could be a crippling incident, but you say you took down your own cloud and did so accidentally... can you provide a similar scenario where a non-admin user is able to intentionally bring about the same result? That's mostly what I'm looking for to be able to formulate an appropriate impact description for a possible security vulnerability advisory publication. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1818239 Title: scheduler: build failure high negative weighting To manage notifications about this bug go to: https://bugs.launchpad.net/charm-nova-cloud-controller/+bug/1818239/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1818239] Re: scheduler: build failure high negative weighting
Thanks! I'm mostly looking for an exploit scenario whereby a malicious actor can intentionally cause harm/deny access to the operating environment for other users. Absent this, we'd probably not bother to issue a security advisory about it. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1818239 Title: scheduler: build failure high negative weighting To manage notifications about this bug go to: https://bugs.launchpad.net/charm-nova-cloud-controller/+bug/1818239/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1818239] Re: scheduler: build failure high negative weighting
Is the denial of service concern that an authenticated user could engineer a build failure (perhaps by attempting to boot an intentionally corrupt image they uploaded) and perform that action repeatedly to cause the environment to no longer to be able to schedule instances to any of the hypervisor hosts through which their build failures rotated? -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1818239 Title: scheduler: build failure high negative weighting To manage notifications about this bug go to: https://bugs.launchpad.net/charm-nova-cloud-controller/+bug/1818239/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1811098] Re: [SRU] ceilometer writing snmp credentials to log file
A CVE can be requested by anyone for any defect. The OpenStack VMT doesn't generally request CVEs for projects it doesn't oversee, but we have a brief overview of what we'd generally recommend putting in MITRE's CVE Request form documented at https://security.openstack.org /vmt-process.html#send-cve-request if you're interested in following a similar process. Note that for an already-public report like this one, there are fewer bits to worry about (the process documentation attempts to call out the difference between what you'd do for still private embargoed reports vs already public reports). -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1811098 Title: [SRU] ceilometer writing snmp credentials to log file To manage notifications about this bug go to: https://bugs.launchpad.net/ceilometer/+bug/1811098/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1746992] Re: gnocchi-api in Bionic uses python3, and libapache2-mod-wsgi-py3 conflicts with the python 2 version
https://packages.ubuntu.com/bionic/gnocchi-api seems to indicate it's coming straight through an import from Debian, where the current OpenStack ecosystem is packaged to use only Python 3.x. This probably makes it incompatible with the official Ubuntu OpenStack packaging which still relies on Python 2.7. If I were to guess, Gnocchi isn't included due to it not officially being part of OpenStack any longer (the developers decided to move out of OpenStack and form their own community around Gnocchi in March of 2017). -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1746992 Title: gnocchi-api in Bionic uses python3, and libapache2-mod-wsgi-py3 conflicts with the python 2 version To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/gnocchi/+bug/1746992/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1664931] Re: [OSSA-2017-005] nova rebuild ignores all image properties and scheduler filters (CVE-2017-16239)
** Changed in: ossa Status: Fix Committed => Fix Released -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1664931 Title: [OSSA-2017-005] nova rebuild ignores all image properties and scheduler filters (CVE-2017-16239) To manage notifications about this bug go to: https://bugs.launchpad.net/nova/+bug/1664931/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1663462] Re: weather-util needs updated due to NWS changes
This is fixed by the weather-util 2.3-2 source package in Artful, if someone wants to attempt an SRU of that to Trusty and/or Xenial. ** Changed in: weather-util (Ubuntu) Status: New => Fix Released ** Changed in: weather-util (Ubuntu) Assignee: (unassigned) => Jeremy Stanley (fungi) -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1663462 Title: weather-util needs updated due to NWS changes To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/weather-util/+bug/1663462/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1663462] Re: weather-util needs updated due to NWS changes
This is fixed by the weather-util-data 2.3-1 package in Zesty, but that version of weather-util contains a nasty Py3k incompatibility which is fixed in the 2.3-2 package which just migrated to Debian testing today and so should probably get auto-imported to Zesty soon (after which we can think about an SRU). -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1663462 Title: weather-util needs updated due to NWS changes To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/weather-util/+bug/1663462/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1621179] Re: weather can not get data ( http://weather.noaa.gov has been discontinued)
This was fixed in the 2.3-1 upload to Debian/sid, subsequently imported to Ubuntu/zesty. ** Changed in: weather-util (Ubuntu) Assignee: (unassigned) => Jeremy Stanley (fungi) ** Changed in: weather-util (Ubuntu) Status: Triaged => Fix Released -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1621179 Title: weather can not get data ( http://weather.noaa.gov has been discontinued) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/weather-util/+bug/1621179/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1449062] Re: [OSSA 2016-012] qemu-img calls need to be restricted by ulimit (CVE-2015-5162)
** Summary changed: - qemu-img calls need to be restricted by ulimit (CVE-2015-5162) + [OSSA 2016-012] qemu-img calls need to be restricted by ulimit (CVE-2015-5162) ** Changed in: ossa Status: In Progress => Fix Released -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1449062 Title: [OSSA 2016-012] qemu-img calls need to be restricted by ulimit (CVE-2015-5162) To manage notifications about this bug go to: https://bugs.launchpad.net/cinder/+bug/1449062/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1449062] Re: qemu-img calls need to be restricted by ulimit (CVE-2015-5162)
Status update: it looks like all Glance and Nova fixes have merged; so too have the master and stable/newton changes for Cinder. At this point we're waiting for https://review.openstack.org/375625 (Cinder's stable/mitaka fix) to merge, and we don't seem to have a stable/liberty backport for Cinder. Sean: were you planning to work on a liberty change for this? Or is stable/liberty of Cinder unaffected (in which case I need to adjust the impact description accordingly)? -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1449062 Title: qemu-img calls need to be restricted by ulimit (CVE-2015-5162) To manage notifications about this bug go to: https://bugs.launchpad.net/cinder/+bug/1449062/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1449062] Re: qemu-img calls need to be restricted by ulimit (CVE-2015-5162)
Tristan: I'm still a little confused on the oslo.concurrency recommendation. Are you saying that we should suggest stable/liberty and stable/mitaka deployments to also use oslo.concurrency>=3.8.0? At the moment the tips of stable/liberty and stable/mitaka branches for oslo.concurrency are tagged 2.6.1 and 3.7.1 respectively (and that's what we have pinned in upper-constraints.txt for testing purposes as well). I don't want to imply in an advisory that all deployments should upgrade oslo.concurrency to 3.8.0 or later if there's a risk it will break liberty or mitaka deployments (which is why I was leaning toward not mentioning oslo.concurrency versions as that would just add to confusion). -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1449062 Title: qemu-img calls need to be restricted by ulimit (CVE-2015-5162) To manage notifications about this bug go to: https://bugs.launchpad.net/cinder/+bug/1449062/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1449062] Re: qemu-img calls need to be restricted by ulimit (CVE-2015-5162)
Hemanth, Daniel: So that means the current patches to Nova are insufficient because they missed `qemu-image convert` invocations? For example at http://git.openstack.org/cgit/openstack/nova/tree/nova/virt/xenapi/vm_utils.py#n1128 Tristan: Thanks, it looked like oslo.concurrency got backports to stable/mitaka and stable/liberty to support it too though. Is that correct? If so we may need to get much more verbose about the library versions required by the service fixes. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1449062 Title: qemu-img calls need to be restricted by ulimit (CVE-2015-5162) To manage notifications about this bug go to: https://bugs.launchpad.net/cinder/+bug/1449062/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1449062] Re: qemu-img calls need to be restricted by ulimit (CVE-2015-5162)
Following discussion with Sean and Hemanth, it looks like we ought to get fixes for this into supported branches of Cinder and Glance after all. Hopefully getting them merged goes quickly now that Nova has already trodden this ground and the fixes are basically identical between them. Assuming all fixes merge before Newton releases and prior to any stable branch point releases, this is the updated proposed impact description. I'm using our YAML format here both for convenience and clarity due to the number of repos and releases involved. I've also shortened the title and referenced the affected software in it. Should I include a note about the updated versions of oslo.concurrency required, or are the references to patches in consuming projects sufficient for this purpose? I'd like to avoid unnecessary additional complexity if possible here. -- date: TBD id: TBD title: Malicious qemu-img input may exhaust resources in Cinder, Glance, Nova description: > Richard W.M. Jones of Red Hat reported a vulnerability that affects OpenStack Cinder, Glance and Nova. By providing a maliciously crafted disk image an attacker can consume considerable amounts of RAM and CPU time resulting in a denial of service via resource exhaustion. Any project which makes calls to qemu-img without appropriate ulimit restrictions in place is affected by this flaw. affected-products: - product: cinder version: "<=7.0.2, >=8.0.0 <=8.1.1" - product: glance version: "<=11.0.1, ==12.0.0" - product: nova version: "<=12.0.4 and ==13.0.0" vulnerabilities: - cve-id: CVE-2015-5162 reporters: - name: Richard W.M. Jones affiliation: Red Hat reported: - CVE-2015-5162 issues: links: - https://launchpad.net/bugs/1449062 reviews: ocata: - https://review.openstack.org/375099 (cinder) - https://review.openstack.org/TBD (glance) newton: - https://review.openstack.org/375102 (cinder) - https://review.openstack.org/TBD (glance) - https://review.openstack.org/307663 (nova) mitaka: - https://review.openstack.org/TBD (cinder) - https://review.openstack.org/TBD (glance) - https://review.openstack.org/326327 (nova) liberty: - https://review.openstack.org/TBD (cinder) - https://review.openstack.org/TBD (glance) - https://review.openstack.org/327624 (nova) notes: - > Separate Ocata patches are listed for Cinder and Glance, as they were fixed during the Newton release freeze after it branched from master. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1449062 Title: qemu-img calls need to be restricted by ulimit (CVE-2015-5162) To manage notifications about this bug go to: https://bugs.launchpad.net/cinder/+bug/1449062/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1449062] Re: qemu-img calls need to be restricted by ulimit (CVE-2015-5162)
I'm resurrecting Grant's proposed impact description from comment #28 and updating for the year of time which has passed since. I've also edited it to remove references to Cinder and Glance... are those effectively still impacted in any supported branches? I see that the tasks API in Glance becoming admin-only in Mitaka results in this being impractical there, but what about for Liberty? And there's little input from Cinder on this bug at all but the claim is that it's exploitable there as well. Is that still the case today? -- Title: Malicious input to qemu-img may result in resource exhaustion Reporter: Richard W.M. Jones Product: Nova Affects: <=12.0.4, ==13.0.0 Description: Richard W.M. Jones of Red Hat reported a vulnerability that affects OpenStack Nova. By providing a maliciously crafted disk image an attacker can consume considerable amounts of RAM and CPU time resulting in a denial of service via resource exhaustion. Any project which makes calls to qemu-img without appropriate ulimit restrictions in place is affected by this flaw. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1449062 Title: qemu-img calls need to be restricted by ulimit (CVE-2015-5162) To manage notifications about this bug go to: https://bugs.launchpad.net/cloud-archive/+bug/1449062/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1449062] Re: qemu-img calls need to be restricted by ulimit (CVE-2015-5162)
** Changed in: ossa Status: Incomplete => In Progress ** Changed in: ossa Assignee: (unassigned) => Jeremy Stanley (fungi) -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1449062 Title: qemu-img calls need to be restricted by ulimit (CVE-2015-5162) To manage notifications about this bug go to: https://bugs.launchpad.net/cloud-archive/+bug/1449062/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1449062] Re: qemu-img calls need to be restricted by ulimit (CVE-2015-5162)
Based on the thread at http://lists.openstack.org/pipermail/openstack- dev/2016-September/104091.html we may need to figure out how to adjust the messaging to indicate that it was a severe enough bug to fix in stable/mitaka but that stable/liberty will be left unfixed. ** Changed in: ossa Status: Confirmed => Incomplete -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1449062 Title: qemu-img calls need to be restricted by ulimit (CVE-2015-5162) To manage notifications about this bug go to: https://bugs.launchpad.net/cloud-archive/+bug/1449062/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1376316] Re: nova absolute-limits floating ip count is incorrect in a neutron based deployment
** Information type changed from Public Security to Public -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1376316 Title: nova absolute-limits floating ip count is incorrect in a neutron based deployment To manage notifications about this bug go to: https://bugs.launchpad.net/neutron/+bug/1376316/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1422046] Re: cinder backup-list is always listing all tenants's bug for admin
Correct, we consider that latter case a "security hardening opportunity" and I'm triaging this report as one now (class D in our taxonomy https://security.openstack.org/vmt-process.html#incident-report-taxonomy ). Depending on severity and available time from editors in the Security Team, these sorts of issues sometimes get an OpenStack Security Note published (OSSN rather than OSSA). ** Changed in: ossa Status: Incomplete => Won't Fix ** Information type changed from Public Security to Public ** Tags added: security -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1422046 Title: cinder backup-list is always listing all tenants's bug for admin To manage notifications about this bug go to: https://bugs.launchpad.net/horizon/+bug/1422046/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1422046] Re: cinder backup-list is always listing all tenants's bug for admin
Correct, we consider that latter case a "security hardening opportunity" and I'm triaging this report as one now (class D in our taxonomy https://security.openstack.org/vmt-process.html#incident-report-taxonomy ). Depending on severity and available time from editors in the Security Team, these sorts of issues sometimes get an OpenStack Security Note published (OSSN rather than OSSA). ** Changed in: ossa Status: Incomplete => Won't Fix ** Information type changed from Public Security to Public ** Tags added: security -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to python-cinderclient in Ubuntu. https://bugs.launchpad.net/bugs/1422046 Title: cinder backup-list is always listing all tenants's bug for admin To manage notifications about this bug go to: https://bugs.launchpad.net/horizon/+bug/1422046/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1422046] Re: cinder backup-list is always listing all tenants's bug for admin
It looks like bug 1514396 has been opened for the same issue in the V1 API. -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to python-cinderclient in Ubuntu. https://bugs.launchpad.net/bugs/1422046 Title: cinder backup-list is always listing all tenants's bug for admin To manage notifications about this bug go to: https://bugs.launchpad.net/horizon/+bug/1422046/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1422046] Re: cinder backup-list is always listing all tenants's bug for admin
It looks like bug 1514396 has been opened for the same issue in the V1 API. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1422046 Title: cinder backup-list is always listing all tenants's bug for admin To manage notifications about this bug go to: https://bugs.launchpad.net/horizon/+bug/1422046/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1422046] Re: cinder backup-list is always listing all tenants's bug for admin
While I agree there is a non-negligible risk presented by this behavior, I don't see how a malicious actor could use this flaw to their advantage. As such, it doesn't seem like something for which the OpenStack Vulnerability Management Team would issue an official security advisory. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1422046 Title: cinder backup-list is always listing all tenants's bug for admin To manage notifications about this bug go to: https://bugs.launchpad.net/horizon/+bug/1422046/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1422046] Re: cinder backup-list is always listing all tenants's bug for admin
Sounds like we're agreed that this report concerns a serious bug with security implications (insofar as any means of accidentally destroying your environment is), but is not an exploitable vulnerability, does not need a CVE assignment requested by the VMT and won't lead to any official security advisory publication. -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to python-cinderclient in Ubuntu. https://bugs.launchpad.net/bugs/1422046 Title: cinder backup-list is always listing all tenants's bug for admin To manage notifications about this bug go to: https://bugs.launchpad.net/horizon/+bug/1422046/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1422046] Re: cinder backup-list is always listing all tenants's bug for admin
While I agree there is a non-negligible risk presented by this behavior, I don't see how a malicious actor could use this flaw to their advantage. As such, it doesn't seem like something for which the OpenStack Vulnerability Management Team would issue an official security advisory. -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to python-cinderclient in Ubuntu. https://bugs.launchpad.net/bugs/1422046 Title: cinder backup-list is always listing all tenants's bug for admin To manage notifications about this bug go to: https://bugs.launchpad.net/horizon/+bug/1422046/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1422046] Re: cinder backup-list is always listing all tenants's bug for admin
Sounds like we're agreed that this report concerns a serious bug with security implications (insofar as any means of accidentally destroying your environment is), but is not an exploitable vulnerability, does not need a CVE assignment requested by the VMT and won't lead to any official security advisory publication. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1422046 Title: cinder backup-list is always listing all tenants's bug for admin To manage notifications about this bug go to: https://bugs.launchpad.net/horizon/+bug/1422046/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1422046] Re: cinder backup-list is always listing all tenants's bug for admin
Since this report concerns a possible security risk, an incomplete security advisory task has been added while the core security reviewers for the affected project or projects confirm the bug and discuss the scope of any vulnerability along with potential solutions. ** Also affects: ossa Importance: Undecided Status: New ** Changed in: ossa Status: New => Incomplete -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to python-cinderclient in Ubuntu. https://bugs.launchpad.net/bugs/1422046 Title: cinder backup-list is always listing all tenants's bug for admin To manage notifications about this bug go to: https://bugs.launchpad.net/horizon/+bug/1422046/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1422046] Re: cinder backup-list is always listing all tenants's bug for admin
Since this report concerns a possible security risk, an incomplete security advisory task has been added while the core security reviewers for the affected project or projects confirm the bug and discuss the scope of any vulnerability along with potential solutions. ** Also affects: ossa Importance: Undecided Status: New ** Changed in: ossa Status: New => Incomplete -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1422046 Title: cinder backup-list is always listing all tenants's bug for admin To manage notifications about this bug go to: https://bugs.launchpad.net/horizon/+bug/1422046/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1348954] Re: update Python3 for trusty
Brian, was comment #5 a mis-update? This bug is about getting newer Python 3.4 into Trusty, not a newer python-urllib3 module. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1348954 Title: update Python3 for trusty To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/python3.4/+bug/1348954/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1382607] Re: [SRU] Backport python3.4 logging module backward incompatibility fix.
Based on E-mail discussion with Barry and Matthias, it sounds like the plan now is to SRU MRE Python 3.4.3 into Trusty once it's available (due out February 22, 2015 according to the official release schedule). -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1382607 Title: [SRU] Backport python3.4 logging module backward incompatibility fix. To manage notifications about this bug go to: https://bugs.launchpad.net/python/+bug/1382607/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1348954] Re: update Python3 for trusty
Based on E-mail discussion with Barry and Matthias, it sounds like the plan now is to SRU MRE Python 3.4.3 into Trusty once it's available (due out February 22, 2015 according to the official release schedule). -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1348954 Title: update Python3 for trusty To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/python3.4/+bug/1348954/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1367907] Re: Segfault in gc with cyclic trash
Based on E-mail discussion with Barry and Matthias, it sounds like the plan now is to SRU MRE Python 3.4.3 into Trusty once it's available (due out February 22, 2015 according to the official release schedule). -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1367907 Title: Segfault in gc with cyclic trash To manage notifications about this bug go to: https://bugs.launchpad.net/oslo.messaging/+bug/1367907/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 832507] Re: console.log grows indefinitely
It's now (UTC) Thursday. ** Changed in: ossa Status: Incomplete = Won't Fix ** Tags added: security ** Information type changed from Public Security to Public -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to nova in Ubuntu. https://bugs.launchpad.net/bugs/832507 Title: console.log grows indefinitely To manage notifications about this bug go to: https://bugs.launchpad.net/nova/+bug/832507/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 832507] Re: console.log grows indefinitely
It's now (UTC) Thursday. ** Changed in: ossa Status: Incomplete = Won't Fix ** Tags added: security ** Information type changed from Public Security to Public -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/832507 Title: console.log grows indefinitely To manage notifications about this bug go to: https://bugs.launchpad.net/nova/+bug/832507/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 832507] Re: console.log grows indefinitely
Agreed, this is class C2 (a vulnerability in some dependency, not in OpenStack code, and so nothing we're going to fix with a patch to OpenStack security supported projects nor anything for which we should issue a security advisory). If there are no disagreements, I'll switch this to a regular public bug and mark the security advisory task won't fix on Thursday. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/832507 Title: console.log grows indefinitely To manage notifications about this bug go to: https://bugs.launchpad.net/nova/+bug/832507/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 832507] Re: console.log grows indefinitely
Agreed, this is class C2 (a vulnerability in some dependency, not in OpenStack code, and so nothing we're going to fix with a patch to OpenStack security supported projects nor anything for which we should issue a security advisory). If there are no disagreements, I'll switch this to a regular public bug and mark the security advisory task won't fix on Thursday. -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to nova in Ubuntu. https://bugs.launchpad.net/bugs/832507 Title: console.log grows indefinitely To manage notifications about this bug go to: https://bugs.launchpad.net/nova/+bug/832507/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 832507] Re: console.log grows indefinitely
** Changed in: ossa Assignee: hzxiongwenwu (xwwzzy) = (unassigned) -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to nova in Ubuntu. https://bugs.launchpad.net/bugs/832507 Title: console.log grows indefinitely To manage notifications about this bug go to: https://bugs.launchpad.net/nova/+bug/832507/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 832507] Re: console.log grows indefinitely
** Changed in: ossa Assignee: hzxiongwenwu (xwwzzy) = (unassigned) -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/832507 Title: console.log grows indefinitely To manage notifications about this bug go to: https://bugs.launchpad.net/nova/+bug/832507/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1367907] Re: Segfault in gc with cyclic trash
Is the plan to solve this in Trusty via bug 1348954 or to separately SRU the upstream patch? -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1367907 Title: Segfault in gc with cyclic trash To manage notifications about this bug go to: https://bugs.launchpad.net/oslo.messaging/+bug/1367907/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1348954] Re: update Python3 for trusty
Is there any chance we could get latest upstream 3.4 SRU'd soon? We're tracking a couple of relatively serious regressions issues fixed upstream but still present in Trusty. See bug 1367907 and bug 1382607 for details. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1348954 Title: update Python3 for trusty To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/python3.4/+bug/1348954/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1382607] Re: [SRU] Backport python3.4 logging module backward incompatibility fix.
Is the plan to solve this in Trusty via bug 1348954 or to separately SRU the upstream patch? -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1382607 Title: [SRU] Backport python3.4 logging module backward incompatibility fix. To manage notifications about this bug go to: https://bugs.launchpad.net/python/+bug/1382607/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1367907] Re: Segfault in gc with cyclic trash
I've confirmed that upgrading a Trusty/amd64 VM to the python3.4 packages in that PPA fixes the issue we observed running unit tests for OpenStack's oslo.messaging project under that interpreter. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1367907 Title: Segfault in gc with cyclic trash To manage notifications about this bug go to: https://bugs.launchpad.net/oslo.messaging/+bug/1367907/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1379201] Re: openvswitch-datapath-dkms 1.4.6-0ubuntu1.12.04.3: openvswitch kernel module failed to build
** Also affects: neutron Importance: Undecided Status: New -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to openvswitch in Ubuntu. https://bugs.launchpad.net/bugs/1379201 Title: openvswitch-datapath-dkms 1.4.6-0ubuntu1.12.04.3: openvswitch kernel module failed to build To manage notifications about this bug go to: https://bugs.launchpad.net/neutron/+bug/1379201/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1379201] Re: openvswitch-datapath-dkms 1.4.6-0ubuntu1.12.04.3: openvswitch kernel module failed to build
** Also affects: neutron Importance: Undecided Status: New -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1379201 Title: openvswitch-datapath-dkms 1.4.6-0ubuntu1.12.04.3: openvswitch kernel module failed to build To manage notifications about this bug go to: https://bugs.launchpad.net/neutron/+bug/1379201/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1368418] [NEW] Fatal RPython error: KeyError/Crash in JIT!
Public bug reported: Trusty's pypy 2.2.1+dfsg-1 package seems to be affected by PyPy bugs https://bitbucket.org/pypy/pypy/issue/1669 and https://bitbucket.org/pypy/pypy/issue/1694/ (which are probably duplicates manifesting in a couple ways). This bug is fixed in https://bitbucket.org/pypy/pypy/commits/5ca1994 . Trusty should pull this fix into the pypy package. Note this definitely affects some python projects. `git clone https://git.openstack.org/openstack/zaqar.git cd zaqar tox -e pypy` will trigger this. With the pypy 2.3.1+dfsg-1~ppa1 package I'm unable to reproduce the error. Now for details, broken using: $ lsb_release -rd Description: Ubuntu 14.04.1 LTS Release: 14.04 $ apt-cache policy pypy pypy: Installed: 2.2.1+dfsg-1 Candidate: 2.2.1+dfsg-1 Version table: *** 2.2.1+dfsg-1 0 500 http://us.archive.ubuntu.com/ubuntu/ trusty/universe amd64 Packages 100 /var/lib/dpkg/status [Impact] This bug can cause processes that tickle it to crash PyPy's JIT. This means there could be a significant number of Python programs that are broken when run under this interpreter. The fix for this bug should be backported to avoid seemingly random and hard to debug JIT crashes from happening when users use pypy. [Test Case] git clone https://git.openstack.org/openstack/zaqar.git cd zaqar tox -e pypy # This should end with aborting during test discovery. Note if you don't have tox installed you will need to install version 1.7.2 or greater. `sudo pip install tox==1.7.2` will do this. [Regression Potential] The patch in question is small. If we go straight to pypy 2.3.x the diff will be larger but that isn't necessary to fix this particular issue. The biggest regression potential would be that heap cache management ends up broken by the this bug fix. ** Affects: zaqar Importance: Undecided Status: New ** Affects: pypy (Ubuntu) Importance: Undecided Status: New ** Also affects: zaqar Importance: Undecided Status: New -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1368418 Title: Fatal RPython error: KeyError/Crash in JIT! To manage notifications about this bug go to: https://bugs.launchpad.net/zaqar/+bug/1368418/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1294874] Re: Sub-process /usr/bin/dpkg returned an error code
** Tags added: gate-failure ** Changed in: openstack-ci Status: New = Triaged ** Changed in: openstack-ci Importance: Undecided = Medium -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1294874 Title: Sub-process /usr/bin/dpkg returned an error code To manage notifications about this bug go to: https://bugs.launchpad.net/openstack-ci/+bug/1294874/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1308050] Re: git-review crashes when using it with Python 2 (not with Python 3)
** Changed in: git-review Importance: Undecided = High ** Changed in: git-review Assignee: (unassigned) = Matthieu Baerts (matttbe) ** Changed in: git-review Status: Fix Committed = Fix Released -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1308050 Title: git-review crashes when using it with Python 2 (not with Python 3) To manage notifications about this bug go to: https://bugs.launchpad.net/git-review/+bug/1308050/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1284718] Re: interface-attach to external network a) works and b) results in undeletable instances
Seems there's consensus that this is not an exploitable vulnerability. Also, the bug was originally, even if only very briefly, public when it was first opened (thus broader exposure has already compromised any effective embargo). ** Changed in: ossa Status: Incomplete = Invalid ** Information type changed from Private Security to Public -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to neutron in Ubuntu. https://bugs.launchpad.net/bugs/1284718 Title: interface-attach to external network a) works and b) results in undeletable instances To manage notifications about this bug go to: https://bugs.launchpad.net/neutron/+bug/1284718/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1284718] Re: interface-attach to external network a) works and b) results in undeletable instances
Seems there's consensus that this is not an exploitable vulnerability. Also, the bug was originally, even if only very briefly, public when it was first opened (thus broader exposure has already compromised any effective embargo). ** Changed in: ossa Status: Incomplete = Invalid ** Information type changed from Private Security to Public -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1284718 Title: interface-attach to external network a) works and b) results in undeletable instances To manage notifications about this bug go to: https://bugs.launchpad.net/neutron/+bug/1284718/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1228977] Re: n-cpu seems to crash when running with libvirt 1.0.6 from ubuntu cloud archive
Note that we inadvertently tested libvirt from UCA on all our CI infrastructure today and ran into bug 1266711 (probably related). -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1228977 Title: n-cpu seems to crash when running with libvirt 1.0.6 from ubuntu cloud archive To manage notifications about this bug go to: https://bugs.launchpad.net/cloud-archive/+bug/1228977/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1228977] Re: n-cpu seems to crash when running with libvirt 1.0.6 from ubuntu cloud archive
I got a few minutes to recreate the failing test run and tarred up the screen-n-*.log files (attached) once it finished. ** Attachment added: Nova screen logs from failing tempest run https://bugs.launchpad.net/nova/+bug/1228977/+attachment/3919446/+files/screen-n-logs.tar.xz -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1228977 Title: n-cpu seems to crash when running with libvirt 1.0.6 from ubuntu cloud archive To manage notifications about this bug go to: https://bugs.launchpad.net/cloud-archive/+bug/1228977/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1228977] Re: n-cpu seems to crash when running with libvirt 1.0.6 from ubuntu cloud archive
Adding the libvirt log as Chuck requested in IRC just now. ** Attachment added: libvirtd.log https://bugs.launchpad.net/nova/+bug/1228977/+attachment/3919471/+files/libvirtd.log -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1228977 Title: n-cpu seems to crash when running with libvirt 1.0.6 from ubuntu cloud archive To manage notifications about this bug go to: https://bugs.launchpad.net/cloud-archive/+bug/1228977/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1228977] Re: n-cpu seems to crash when running with libvirt 1.0.6 from ubuntu cloud archive
Worth noting, when running full tempest on an 8GB DevStack VM in both Rackspace and HPCloud with Ubuntu Cloud Archive added to the sources list, I get numerous job failures with corresponding repetitions of this in the console: Traceback (most recent call last): File tempest/scenario/test_server_basic_ops.py, line 107, in test_server_basicops self.boot_instance() File tempest/scenario/test_server_basic_ops.py, line 59, in boot_instance instance = self.create_server(create_kwargs=create_kwargs) File tempest/scenario/manager.py, line 412, in create_server self.status_timeout(client.servers, server.id, 'ACTIVE') File tempest/scenario/manager.py, line 304, in status_timeout not_found_exception=not_found_exception) File tempest/scenario/manager.py, line 358, in _status_timeout self.config.compute.build_interval): File tempest/test.py, line 290, in call_until_true if func(): File tempest/scenario/manager.py, line 349, in check_status raise exceptions.BuildErrorException(message) BuildErrorException: Server %(server_id)s failed to build and is in ERROR status Details: Server: scenario-server--tempest-1807499527 failed to get to expected status. In ERROR state. Removing UCA from the sources list, all tests complete as expected. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1228977 Title: n-cpu seems to crash when running with libvirt 1.0.6 from ubuntu cloud archive To manage notifications about this bug go to: https://bugs.launchpad.net/cloud-archive/+bug/1228977/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1228977] Re: n-cpu seems to crash when running with libvirt 1.0.6 from ubuntu cloud archive
Probably--I wasn't collecting logs, just confirming whether or not gating is going to break if we reenable UCA. If nobody with nova debugging experience or interest in using UCA/newer libvirt has time to repeat that experiment, I can recreate it and find/attach the service logs some time in the next few days. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1228977 Title: n-cpu seems to crash when running with libvirt 1.0.6 from ubuntu cloud archive To manage notifications about this bug go to: https://bugs.launchpad.net/cloud-archive/+bug/1228977/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1245676] Re: pip install pbr==0.5.22 fails unless run twice on ubuntu 12.04
** Also affects: pbr Importance: Undecided Status: New -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1245676 Title: pip install pbr==0.5.22 fails unless run twice on ubuntu 12.04 To manage notifications about this bug go to: https://bugs.launchpad.net/pbr/+bug/1245676/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1210822] Re: Please import 0.8.8b+dfsg-2 from Debian and backport security fixes to 12.04 LTS
I get a clean cacti_0.8.7i-2ubuntu1.1_all.deb via 'debuild -b -uc -us' on an up to date precise VM with this debdiff applied, though lintian is mildly displeased with your changelog.Debian addition... Now running lintian... W: cacti: debian-changelog-line-too-long line 4 W: cacti: debian-changelog-line-too-long line 6 N: 1 tag overridden (1 warning) Finished running lintian. Upgraded our server with it and seems not broken, but we don't use any authenticated/admin functions so YMMV. ** Changed in: cacti (Ubuntu) Status: Triaged = Confirmed -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1210822 Title: Please import 0.8.8b+dfsg-2 from Debian and backport security fixes to 12.04 LTS To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/cacti/+bug/1210822/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1210822] [NEW] Please import 0.8.8b+dfsg-2 from Debian and backport security fixes to 12.04 LTS
*** This bug is a security vulnerability *** Public security bug reported: The cacti source in Debian/sid as of today now addresses CVE-2013-1434 and CVE-2013-1435. ** Affects: cacti (Ubuntu) Importance: Undecided Status: New ** Information type changed from Private Security to Public Security ** CVE added: http://www.cve.mitre.org/cgi- bin/cvename.cgi?name=2013-1434 ** CVE added: http://www.cve.mitre.org/cgi- bin/cvename.cgi?name=2013-1435 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1210822 Title: Please import 0.8.8b+dfsg-2 from Debian and backport security fixes to 12.04 LTS To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/cacti/+bug/1210822/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1193172] Re: Populating Hyper-V MSR for Ubuntu 13.10
** No longer affects: git-review -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1193172 Title: Populating Hyper-V MSR for Ubuntu 13.10 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1193172/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1069894] Re: Sphinx fails to build on raring
Upstream Sphinx issue report is at: https://bitbucket.org/birkenfeld/sphinx/issue/998/docutils-010-will- break-sphinx-manpage -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1069894 Title: Sphinx fails to build on raring To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/sphinx/+bug/1069894/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
