[Bug 1015531] Re: Remote arbitrary file corruption / creation flaw via injected files
** Changed in: nova/diablo Assignee: Thierry Carrez (ttx) => (unassigned) -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1015531 Title: Remote arbitrary file corruption / creation flaw via injected files To manage notifications about this bug go to: https://bugs.launchpad.net/nova/+bug/1015531/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1015531] Re: Remote arbitrary file corruption / creation flaw via injected files
** No longer affects: nova/diablo -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1015531 Title: Remote arbitrary file corruption / creation flaw via injected files To manage notifications about this bug go to: https://bugs.launchpad.net/nova/+bug/1015531/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1015531] Re: Remote arbitrary file corruption / creation flaw via injected files
** Changed in: nova Milestone: folsom-2 => 2012.2 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1015531 Title: Remote arbitrary file corruption / creation flaw via injected files To manage notifications about this bug go to: https://bugs.launchpad.net/nova/+bug/1015531/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1015531] Re: Remote arbitrary file corruption / creation flaw via injected files
Test coverage log. ** Attachment added: "2012.1.3+stable-20120827-4d2a4afe-0ubuntu1.log" https://bugs.launchpad.net/bugs/1015531/+attachment/3283238/+files/2012.1.3%2Bstable-20120827-4d2a4afe-0ubuntu1.log ** Tags added: verification-done -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1015531 Title: Remote arbitrary file corruption / creation flaw via injected files To manage notifications about this bug go to: https://bugs.launchpad.net/nova/+bug/1015531/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1015531] Re: Remote arbitrary file corruption / creation flaw via injected files
This bug was fixed in the package nova - 2012.1.3+stable-20120827 -4d2a4afe-0ubuntu1 --- nova (2012.1.3+stable-20120827-4d2a4afe-0ubuntu1) precise-proposed; urgency=low * New upstream snapshot, fixes FTBFS in -proposed. (LP: #1041120) * Resynchronize with stable/essex (4d2a4afe): - [5d63601] Inappropriate exception handling on kvm live/block migration (LP: #917615) - [ae280ca] Deleted floating ips can cause instance delete to fail (LP: #1038266) nova (2012.1.3+stable-20120824-86fb7362-0ubuntu1) precise-proposed; urgency=low * New upstream snapshot. (LP: #1041120) * Dropped, superseded by new snapshot: - debian/patches/CVE-2012-3447.patch: [d9577ce] - debian/patches/CVE-2012-3371.patch: [25f5bd3] - debian/patches/CVE-2012-3360+3361.patch: [b0feaff] * Resynchronize with stable/essex (86fb7362): - [86fb736] Libvirt driver reports incorrect error when volume-detach fails (LP: #1029463) - [272b98d] nova delete lxc-instance umounts the wrong rootfs (LP: #971621) - [09217ab] Block storage connections are NOT restored on system reboot (LP: #1036902) - [d9577ce] CVE-2012-3361 not fully addressed (LP: #1031311) - [e8ef050] pycrypto is unused and the existing code is potentially insecure to use (LP: #1033178) - [3b4ac31] cannot umount guestfs (LP: #1013689) - [f8255f3] qpid_heartbeat setting in ineffective (LP: #1030430) - [413c641] Deallocation of fixed IP occurs before security group refresh leading to potential security issue in error / race conditions (LP: #1021352) - [219c5ca] Race condition in network/deallocate_for_instance() leads to security issue (LP: #1021340) - [f2bc403] cleanup_file_locks does not remove stale sentinel files (LP: #1018586) - [4c7d671] Deleting Flavor currently in use by instance creates error (LP: #994935) - [7e88e39] nova testsuite errors on newer versions of python-boto (e.g. 2.5.2) (LP: #1027984) - [80d3026] NoMoreFloatingIps: Zero floating ips available after repeatedly creating and destroying instances over time (LP: #1017418) - [4d74631] Launching with source groups under load produces lazy load error (LP: #1018721) - [08e5128] API 'v1.1/{tenant_id}/os-hosts' does not return a list of hosts (LP: #1014925) - [801b94a] Restarting nova-compute removes ip packet filters (LP: #1027105) - [f6d1f55] instance live migration should create virtual_size disk image (LP: #977007) - [4b89b4f] [nova][volumes] Exceeding volumes, gigabytes and floating_ips quotas returns general uninformative HTTP 500 error (LP: #1021373) - [6e873bc] [nova][volumes] Exceeding volumes, gigabytes and floating_ips quotas returns general uninformative HTTP 500 error (LP: #1021373) - [7b215ed] Use default qemu-img cluster size in libvirt connection driver - [d3a87a2] Listing flavors with marker set returns 400 (LP: #956096) - [cf6a85a] nova-rootwrap hardcodes paths instead of using /sbin:/usr/sbin:/usr/bin:/bin (LP: #1013147) - [2efc87c] affinity filters don't work if scheduler_hints is None (LP: #1007573) - [48e5f46] metadata injection is broken in xen (LP: #1022036) - [25f5bd3] scheduler hang (DOS) possible with DifferentHostFilter/SameHostFilter (LP: #1017795) - [1c1b858] cannot umount guestfs (LP: #1013689) - [835ba4f] not able to get host total memory in xen with libvirt (LP: #1004298) - [00e5104] Call to network_get_all_by_uuids missing 'db' (LP: #986922) - [4c49df7] [nova][volumes] Exceeding volumes, gigabytes and floating_ips quotas returns general uninformative HTTP 500 error (LP: #1021373) - [19631f3] [nova][volumes] Exceeding volumes quotas logs "VolumeSizeTooLarge" instead of "VolumeLimitExceeded" (LP: #1020634) - [b0feaff] Remote arbitrary file corruption / creation flaw via injected files (LP: #1015531) - [3cb6e57] NoMoreFixedIps: Zero fixed ips available. Nova seems leaking them. (LP: #1014769) - [5d8431b] ram_allocation_ratio does not work (LP: #1016273) - [410060f] test_get_console_output_file requires sudo NOPASSWD (LP: #992805) - [33c2575] Stop/start a KVM instance with volumes attached produces an error state (LP: #1013782) - [6c01c01] Backport tox settings to unbreak jenkins jobs. - [344125f] Set defaultbranch in .gitreview to stable/essex - [9b789be] floating ips are not disassociated from instances on deletion (LP: #997763) - [d89c2f3] qpid timeout causing compute service to crash (LP: #999698) - [caae0e9] floating ips do not display in 'nova list' after association to instance (LP: #939122) - [1dc9f19] impl_qpid doesn't ACK messages (LP: #1012374) - [bc621bc] Restarting nova-network removes ip packet filters (LP: #1000853) - [7870157] Add caching to openstack.common.cfg - [27133ee] Firewall rules f
[Bug 1015531] Re: Remote arbitrary file corruption / creation flaw via injected files
** Changed in: nova (Ubuntu) Status: New => Fix Released ** Also affects: nova (Ubuntu Precise) Importance: Undecided Status: New ** Changed in: nova (Ubuntu Precise) Status: New => Confirmed -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1015531 Title: Remote arbitrary file corruption / creation flaw via injected files To manage notifications about this bug go to: https://bugs.launchpad.net/nova/+bug/1015531/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1015531] Re: Remote arbitrary file corruption / creation flaw via injected files
** Branch linked: lp:~openstack-ubuntu-testing/nova/precise-essex- proposed -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1015531 Title: Remote arbitrary file corruption / creation flaw via injected files To manage notifications about this bug go to: https://bugs.launchpad.net/nova/+bug/1015531/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1015531] Re: Remote arbitrary file corruption / creation flaw via injected files
So, Ubuntu 12.04 LTS should be fixed between: http://www.ubuntu.com/usn/usn-1497-1/ (CVE-2012-3361) http://www.ubuntu.com/usn/usn-1545-1/ (CVE-2012-3447) ** CVE added: http://www.cve.mitre.org/cgi- bin/cvename.cgi?name=2012-3447 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1015531 Title: Remote arbitrary file corruption / creation flaw via injected files To manage notifications about this bug go to: https://bugs.launchpad.net/nova/+bug/1015531/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1015531] Re: Remote arbitrary file corruption / creation flaw via injected files
** Branch linked: lp:ubuntu/precise-proposed/nova -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1015531 Title: Remote arbitrary file corruption / creation flaw via injected files To manage notifications about this bug go to: https://bugs.launchpad.net/nova/+bug/1015531/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs