date:20140709

[Yahoo-eng-team] [Bug 1339564] [NEW] glance image-delete on an image with the status "saving" doesn't delete the image's file from store

2014-07-09 Thread Yogev Rabl

Public bug reported:

Description of problem:
After running the the scenario described in 
bugs.launchpad.net/cinder/+bug/1339545 , I've deleted two images with that were 
stuck in "saving" status with 
# glance image-delete  

both of the image's files were still in the store: 
#ls -l /var/lib/glance/images
-rw-r-. 1 glance glance  2158362624 Jul  9 10:18 
d4da7dea-c94d-4c9e-a987-955a905a7fed
-rw-r-. 1 glance glance  1630994432 Jul  9 10:09 
8532ef07-3dfa-4d63-8537-033c31b16814

Version-Release number of selected component (if applicable):
python-glanceclient-0.12.0-1.el7ost.noarch
python-glance-2014.1-4.el7ost.noarch
openstack-glance-2014.1-4.el7ost.noarch


How reproducible:


Steps to Reproduce:
1. Run the scenario from bugs.launchpad.net/cinder/+bug/1339545
2. Delete the image:
# glance image-delete 


Actual results:
The file is still in the store.

Expected results:
The file has been deleted from the store.

Additional info:
The logs are attached -
images uid's: 
d4da7dea-c94d-4c9e-a987-955a905a7fed
8532ef07-3dfa-4d63-8537-033c31b16814

** Affects: glance
 Importance: Undecided
 Status: New

** Attachment added: "delete_images.log"
   
https://bugs.launchpad.net/bugs/1339564/+attachment/4148612/+files/delete_images.log

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to Glance.
https://bugs.launchpad.net/bugs/1339564

Title:
  glance image-delete on an image with the status "saving" doesn't
  delete the image's file from store

Status in OpenStack Image Registry and Delivery Service (Glance):
  New

Bug description:
  Description of problem:
  After running the the scenario described in 
bugs.launchpad.net/cinder/+bug/1339545 , I've deleted two images with that were 
stuck in "saving" status with 
  # glance image-delete  

  both of the image's files were still in the store: 
  #ls -l /var/lib/glance/images
  -rw-r-. 1 glance glance  2158362624 Jul  9 10:18 
d4da7dea-c94d-4c9e-a987-955a905a7fed
  -rw-r-. 1 glance glance  1630994432 Jul  9 10:09 
8532ef07-3dfa-4d63-8537-033c31b16814

  Version-Release number of selected component (if applicable):
  python-glanceclient-0.12.0-1.el7ost.noarch
  python-glance-2014.1-4.el7ost.noarch
  openstack-glance-2014.1-4.el7ost.noarch

  
  How reproducible:

  
  Steps to Reproduce:
  1. Run the scenario from bugs.launchpad.net/cinder/+bug/1339545
  2. Delete the image:
  # glance image-delete 

  
  Actual results:
  The file is still in the store.

  Expected results:
  The file has been deleted from the store.

  Additional info:
  The logs are attached -
  images uid's: 
  d4da7dea-c94d-4c9e-a987-955a905a7fed
  8532ef07-3dfa-4d63-8537-033c31b16814

To manage notifications about this bug go to:
https://bugs.launchpad.net/glance/+bug/1339564/+subscriptions

-- 
Mailing list: https://launchpad.net/~yahoo-eng-team
Post to : yahoo-eng-team@lists.launchpad.net
Unsubscribe : https://launchpad.net/~yahoo-eng-team
More help   : https://help.launchpad.net/ListHelp

[Yahoo-eng-team] [Bug 1337821] Re: VMDK Volume attach fails while attaching to an instance that is booted from VMDK volume

2014-07-09 Thread Nikola Đipanov

Removing the VMWare tag as looking at  the code it seems to affect all
drivers.

Also marking as invalid for Nova - Horizon should not be making
assumptions about the device name for attach.

** Also affects: horizon
   Importance: Undecided
   Status: New

** Changed in: nova
   Status: New => Invalid

** Tags removed: vmware

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Compute (nova).
https://bugs.launchpad.net/bugs/1337821

Title:
  VMDK Volume attach fails while attaching to an instance that is booted
  from VMDK volume

Status in OpenStack Dashboard (Horizon):
  New
Status in OpenStack Compute (Nova):
  Invalid

Bug description:
  I have booted an instance from a volume, successfully booted,
  now another volume, i try to attach to same instance, it is failing.
  see the stack trace..

  
  2014-07-04 08:56:11.391 TRACE oslo.messaging.rpc.dispatcher raise 
exception.InvalidDevicePath(path=root_device_name)
  2014-07-04 08:56:11.391 TRACE oslo.messaging.rpc.dispatcher 
InvalidDevicePath: The supplied device path (vda) is invalid.
  2014-07-04 08:56:11.391 TRACE oslo.messaging.rpc.dispatcher
  2014-07-04 08:56:11.396 ERROR oslo.messaging._drivers.common 
[req-648122d5-fd39-495b-a3a7-a96bd32091d6 admin admin] Returning exception The 
supplied device path (vda) is invalid. to caller
  2014-07-04 08:56:11.396 ERROR oslo.messaging._drivers.common 
[req-648122d5-fd39-495b-a3a7-a96bd32091d6 admin admin] ['Traceback (most recent 
call last):\n', '  File 
"/usr/local/lib/python2.7/dist-packages/oslo/messaging/rpc/dispatcher.py", line 
134, in _dispatch_and_reply\nincoming.message))\n', '  File 
"/usr/local/lib/python2.7/dist-packages/oslo/messaging/rpc/dispatcher.py", line 
177, in _dispatch\nreturn self._do_dispatch(endpoint, method, ctxt, 
args)\n', '  File 
"/usr/local/lib/python2.7/dist-packages/oslo/messaging/rpc/dispatcher.py", line 
123, in _do_dispatch\nresult = getattr(endpoint, method)(ctxt, 
**new_args)\n', '  File "/opt/stack/nova/nova/compute/manager.py", line 401, in 
decorated_function\nreturn function(self, context, *args, **kwargs)\n', '  
File "/opt/stack/nova/nova/exception.py", line 88, in wrapped\npayload)\n', 
'  File "/opt/stack/nova/nova/openstack/common/excutils.py", line 82, in 
__exit__\nsix.reraise(self.type_, self.value, self.tb)
 \n', '  File "/opt/stack/nova/nova/exception.py", line 71, in wrapped\n
return f(self, context, *args, **kw)\n', '  File 
"/opt/stack/nova/nova/compute/manager.py", line 286, in decorated_function\n
pass\n', '  File "/opt/stack/nova/nova/openstack/common/excutils.py", line 82, 
in __exit__\nsix.reraise(self.type_, self.value, self.tb)\n', '  File 
"/opt/stack/nova/nova/compute/manager.py", line 272, in decorated_function\n
return function(self, context, *args, **kwargs)\n', '  File 
"/opt/stack/nova/nova/compute/manager.py", line 314, in decorated_function\n
kwargs[\'instance\'], e, sys.exc_info())\n', '  File 
"/opt/stack/nova/nova/openstack/common/excutils.py", line 82, in __exit__\n
six.reraise(self.type_, self.value, self.tb)\n', '  File 
"/opt/stack/nova/nova/compute/manager.py", line 302, in decorated_function\n
return function(self, context, *args, **kwargs)\n', '  File 
"/opt/stack/nova/nova/compute/manager.py", line 4201, in 
reserve_block_device_name\nret
 urn do_reserve()\n', '  File 
"/opt/stack/nova/nova/openstack/common/lockutils.py", line 249, in inner\n
return f(*args, **kwargs)\n', '  File 
"/opt/stack/nova/nova/compute/manager.py", line 4188, in do_reserve\n
context, instance, bdms, device)\n', '  File 
"/opt/stack/nova/nova/compute/utils.py", line 106, in 
get_device_name_for_instance\nmappings[\'root\'], device)\n', '  File 
"/opt/stack/nova/nova/compute/utils.py", line 155, in get_next_device_name\n
raise exception.InvalidDevicePath(path=root_device_name)\n', 
'InvalidDevicePath: The supplied device path (vda) is invalid.\n']

To manage notifications about this bug go to:
https://bugs.launchpad.net/horizon/+bug/1337821/+subscriptions

-- 
Mailing list: https://launchpad.net/~yahoo-eng-team
Post to : yahoo-eng-team@lists.launchpad.net
Unsubscribe : https://launchpad.net/~yahoo-eng-team
More help   : https://help.launchpad.net/ListHelp

[Yahoo-eng-team] [Bug 1337821] Re: VMDK Volume attach fails while attaching to an instance that is booted from VMDK volume

2014-07-09 Thread Chinmaya Bharadwaj

** Changed in: horizon
   Status: New => Invalid

** Changed in: nova
   Status: Invalid => In Progress

** Changed in: horizon
 Assignee: Chinmaya Bharadwaj (acbharadwaj) => (unassigned)

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Compute (nova).
https://bugs.launchpad.net/bugs/1337821

Title:
  VMDK Volume attach fails while attaching to an instance that is booted
  from VMDK volume

Status in OpenStack Dashboard (Horizon):
  Invalid
Status in OpenStack Compute (Nova):
  In Progress

Bug description:
  I have booted an instance from a volume, successfully booted,
  now another volume, i try to attach to same instance, it is failing.
  see the stack trace..

  2014-07-04 08:56:11.391 TRACE oslo.messaging.rpc.dispatcher raise 
exception.InvalidDevicePath(path=root_device_name)
  2014-07-04 08:56:11.391 TRACE oslo.messaging.rpc.dispatcher 
InvalidDevicePath: The supplied device path (vda) is invalid.
  2014-07-04 08:56:11.391 TRACE oslo.messaging.rpc.dispatcher
  2014-07-04 08:56:11.396 ERROR oslo.messaging._drivers.common 
[req-648122d5-fd39-495b-a3a7-a96bd32091d6 admin admin] Returning exception The 
supplied device path (vda) is invalid. to caller
  2014-07-04 08:56:11.396 ERROR oslo.messaging._drivers.common 
[req-648122d5-fd39-495b-a3a7-a96bd32091d6 admin admin] ['Traceback (most recent 
call last):\n', '  File 
"/usr/local/lib/python2.7/dist-packages/oslo/messaging/rpc/dispatcher.py", line 
134, in _dispatch_and_reply\nincoming.message))\n', '  File 
"/usr/local/lib/python2.7/dist-packages/oslo/messaging/rpc/dispatcher.py", line 
177, in _dispatch\nreturn self._do_dispatch(endpoint, method, ctxt, 
args)\n', '  File 
"/usr/local/lib/python2.7/dist-packages/oslo/messaging/rpc/dispatcher.py", line 
123, in _do_dispatch\nresult = getattr(endpoint, method)(ctxt, 
**new_args)\n', '  File "/opt/stack/nova/nova/compute/manager.py", line 401, in 
decorated_function\nreturn function(self, context, *args, **kwargs)\n', '  
File "/opt/stack/nova/nova/exception.py", line 88, in wrapped\npayload)\n', 
'  File "/opt/stack/nova/nova/openstack/common/excutils.py", line 82, in 
__exit__\nsix.reraise(self.type_, self.value, self.tb)
 \n', '  File "/opt/stack/nova/nova/exception.py", line 71, in wrapped\n
return f(self, context, *args, **kw)\n', '  File 
"/opt/stack/nova/nova/compute/manager.py", line 286, in decorated_function\n
pass\n', '  File "/opt/stack/nova/nova/openstack/common/excutils.py", line 82, 
in __exit__\nsix.reraise(self.type_, self.value, self.tb)\n', '  File 
"/opt/stack/nova/nova/compute/manager.py", line 272, in decorated_function\n
return function(self, context, *args, **kwargs)\n', '  File 
"/opt/stack/nova/nova/compute/manager.py", line 314, in decorated_function\n
kwargs[\'instance\'], e, sys.exc_info())\n', '  File 
"/opt/stack/nova/nova/openstack/common/excutils.py", line 82, in __exit__\n
six.reraise(self.type_, self.value, self.tb)\n', '  File 
"/opt/stack/nova/nova/compute/manager.py", line 302, in decorated_function\n
return function(self, context, *args, **kwargs)\n', '  File 
"/opt/stack/nova/nova/compute/manager.py", line 4201, in 
reserve_block_device_name\nret
 urn do_reserve()\n', '  File 
"/opt/stack/nova/nova/openstack/common/lockutils.py", line 249, in inner\n
return f(*args, **kwargs)\n', '  File 
"/opt/stack/nova/nova/compute/manager.py", line 4188, in do_reserve\n
context, instance, bdms, device)\n', '  File 
"/opt/stack/nova/nova/compute/utils.py", line 106, in 
get_device_name_for_instance\nmappings[\'root\'], device)\n', '  File 
"/opt/stack/nova/nova/compute/utils.py", line 155, in get_next_device_name\n
raise exception.InvalidDevicePath(path=root_device_name)\n', 
'InvalidDevicePath: The supplied device path (vda) is invalid.\n']

  The reason behind this issue is: because of the root device_name being
  set 'vda' in the case of boot from volume, The future volume attaches
  to the VM fail saying "The supplied device path (vda) is invalid"

To manage notifications about this bug go to:
https://bugs.launchpad.net/horizon/+bug/1337821/+subscriptions

-- 
Mailing list: https://launchpad.net/~yahoo-eng-team
Post to : yahoo-eng-team@lists.launchpad.net
Unsubscribe : https://launchpad.net/~yahoo-eng-team
More help   : https://help.launchpad.net/ListHelp

[Yahoo-eng-team] [Bug 1317100] Re: User data should be redacted when logging request spec

2014-07-09 Thread Phil Day

The change to drive provisioning from conductor now avoids the code path
that was logging user data, so the immediate concern has gone away.  Not
carrying user data in the instance object would still be a useful
optimization - but that's a different task.

** Changed in: nova
   Status: In Progress => Invalid

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Compute (nova).
https://bugs.launchpad.net/bugs/1317100

Title:
  User data should be redacted when logging request spec

Status in OpenStack Compute (Nova):
  Invalid

Bug description:
  The filter scheduler has a Debug level log for the request spec, which
  includes in the instance properties the base64 encoded user_data.

  Since this may be used by the user to pass credentials into the VM
  this field should be redacted in the log enrty.

  User data  is an opaque data blob as far as Nova is concerned (and
  hence of no practical use for debugging).

To manage notifications about this bug go to:
https://bugs.launchpad.net/nova/+bug/1317100/+subscriptions

-- 
Mailing list: https://launchpad.net/~yahoo-eng-team
Post to : yahoo-eng-team@lists.launchpad.net
Unsubscribe : https://launchpad.net/~yahoo-eng-team
More help   : https://help.launchpad.net/ListHelp

[Yahoo-eng-team] [Bug 1337821] Re: VMDK Volume attach fails while attaching to an instance that is booted from VMDK volume

2014-07-09 Thread Nikola Đipanov

** No longer affects: horizon

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Compute (nova).
https://bugs.launchpad.net/bugs/1337821

Title:
  VMDK Volume attach fails while attaching to an instance that is booted
  from VMDK volume

Status in OpenStack Compute (Nova):
  In Progress

Bug description:
  I have booted an instance from a volume, successfully booted,
  now another volume, i try to attach to same instance, it is failing.
  see the stack trace..

  2014-07-04 08:56:11.391 TRACE oslo.messaging.rpc.dispatcher raise 
exception.InvalidDevicePath(path=root_device_name)
  2014-07-04 08:56:11.391 TRACE oslo.messaging.rpc.dispatcher 
InvalidDevicePath: The supplied device path (vda) is invalid.
  2014-07-04 08:56:11.391 TRACE oslo.messaging.rpc.dispatcher
  2014-07-04 08:56:11.396 ERROR oslo.messaging._drivers.common 
[req-648122d5-fd39-495b-a3a7-a96bd32091d6 admin admin] Returning exception The 
supplied device path (vda) is invalid. to caller
  2014-07-04 08:56:11.396 ERROR oslo.messaging._drivers.common 
[req-648122d5-fd39-495b-a3a7-a96bd32091d6 admin admin] ['Traceback (most recent 
call last):\n', '  File 
"/usr/local/lib/python2.7/dist-packages/oslo/messaging/rpc/dispatcher.py", line 
134, in _dispatch_and_reply\nincoming.message))\n', '  File 
"/usr/local/lib/python2.7/dist-packages/oslo/messaging/rpc/dispatcher.py", line 
177, in _dispatch\nreturn self._do_dispatch(endpoint, method, ctxt, 
args)\n', '  File 
"/usr/local/lib/python2.7/dist-packages/oslo/messaging/rpc/dispatcher.py", line 
123, in _do_dispatch\nresult = getattr(endpoint, method)(ctxt, 
**new_args)\n', '  File "/opt/stack/nova/nova/compute/manager.py", line 401, in 
decorated_function\nreturn function(self, context, *args, **kwargs)\n', '  
File "/opt/stack/nova/nova/exception.py", line 88, in wrapped\npayload)\n', 
'  File "/opt/stack/nova/nova/openstack/common/excutils.py", line 82, in 
__exit__\nsix.reraise(self.type_, self.value, self.tb)
 \n', '  File "/opt/stack/nova/nova/exception.py", line 71, in wrapped\n
return f(self, context, *args, **kw)\n', '  File 
"/opt/stack/nova/nova/compute/manager.py", line 286, in decorated_function\n
pass\n', '  File "/opt/stack/nova/nova/openstack/common/excutils.py", line 82, 
in __exit__\nsix.reraise(self.type_, self.value, self.tb)\n', '  File 
"/opt/stack/nova/nova/compute/manager.py", line 272, in decorated_function\n
return function(self, context, *args, **kwargs)\n', '  File 
"/opt/stack/nova/nova/compute/manager.py", line 314, in decorated_function\n
kwargs[\'instance\'], e, sys.exc_info())\n', '  File 
"/opt/stack/nova/nova/openstack/common/excutils.py", line 82, in __exit__\n
six.reraise(self.type_, self.value, self.tb)\n', '  File 
"/opt/stack/nova/nova/compute/manager.py", line 302, in decorated_function\n
return function(self, context, *args, **kwargs)\n', '  File 
"/opt/stack/nova/nova/compute/manager.py", line 4201, in 
reserve_block_device_name\nret
 urn do_reserve()\n', '  File 
"/opt/stack/nova/nova/openstack/common/lockutils.py", line 249, in inner\n
return f(*args, **kwargs)\n', '  File 
"/opt/stack/nova/nova/compute/manager.py", line 4188, in do_reserve\n
context, instance, bdms, device)\n', '  File 
"/opt/stack/nova/nova/compute/utils.py", line 106, in 
get_device_name_for_instance\nmappings[\'root\'], device)\n', '  File 
"/opt/stack/nova/nova/compute/utils.py", line 155, in get_next_device_name\n
raise exception.InvalidDevicePath(path=root_device_name)\n', 
'InvalidDevicePath: The supplied device path (vda) is invalid.\n']

  The reason behind this issue is: because of the root device_name being
  set 'vda' in the case of boot from volume, The future volume attaches
  to the VM fail saying "The supplied device path (vda) is invalid"

To manage notifications about this bug go to:
https://bugs.launchpad.net/nova/+bug/1337821/+subscriptions

-- 
Mailing list: https://launchpad.net/~yahoo-eng-team
Post to : yahoo-eng-team@lists.launchpad.net
Unsubscribe : https://launchpad.net/~yahoo-eng-team
More help   : https://help.launchpad.net/ListHelp

[Yahoo-eng-team] [Bug 1292142] Re: Fix some swift based scrubber functional tests

2014-07-09 Thread Stuart McLaren

I re-tested with the latest 'master' and these seem to run ok now:

It looks like these run ok now:

test_delayed_delete   22.34
test_scrubber_app 25.90
test_scrubber_app_against_swift   27.17
test_scrubber_delete_handles_exception26.20
test_scrubber_handles_swift_missing   26.73
test_scrubber_with_metadata_enc   19.67

** Changed in: glance
   Status: Triaged => Fix Released

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to Glance.
https://bugs.launchpad.net/bugs/1292142

Title:
  Fix some swift based scrubber functional tests

Status in OpenStack Image Registry and Delivery Service (Glance):
  Fix Released

Bug description:
  Three of the scrubber tests which rely on swift
  (glance.tests.functional.test_scrubber.TestScrubber) are currently
  failing.

  
  glance.tests.functional.test_scrubber.TestScrubber
  test_delayed_delete   OK  
20.17
  test_scrubber_app OK  
24.21
  test_scrubber_app_against_swift   FAIL
  test_scrubber_delete_handles_exceptionOK  
24.02
  test_scrubber_handles_swift_missing   FAIL
  test_scrubber_with_metadata_enc   FAIL

To manage notifications about this bug go to:
https://bugs.launchpad.net/glance/+bug/1292142/+subscriptions

-- 
Mailing list: https://launchpad.net/~yahoo-eng-team
Post to : yahoo-eng-team@lists.launchpad.net
Unsubscribe : https://launchpad.net/~yahoo-eng-team
More help   : https://help.launchpad.net/ListHelp

[Yahoo-eng-team] [Bug 1280055] Re: Replace nova.db.sqlalchemy.utils with openstack.common.db.sqlalchemy.utils

2014-07-09 Thread Victor Sergeyev

** Changed in: oslo
   Status: Fix Committed => Fix Released

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Compute (nova).
https://bugs.launchpad.net/bugs/1280055

Title:
  Replace nova.db.sqlalchemy.utils with
  openstack.common.db.sqlalchemy.utils

Status in OpenStack Compute (Nova):
  Fix Released
Status in Oslo - a Library of Common OpenStack Code:
  Fix Released

Bug description:
  Most of the code in nova.db.sqlalchemy.utils is also in oslo-
  incubator.openstack.common.db.sqlalchemy.utils, except for the
  modify_indexes method which is not actually even used in the nova db
  migration code anymore now that it's been compacted in icehouse.

  Also, the oslo.db code has been getting synced over to nova more
  frequently lately so rather than keep all of this duplicate code
  around we should move nova to using the oslo utils code and drop the
  internal nova one, with maybe moving the modify_indexes method to oslo
  first, then sync back to nova and then drop nova.db.sqlalchemy.utils
  from nova.

  We will have to make sure that there are no behavior differences in
  the oslo code such that it would change the nova db schema, but we
  should be able to use Dan Prince's nova/tools/db/schema_diff.py script
  to validate that.

To manage notifications about this bug go to:
https://bugs.launchpad.net/nova/+bug/1280055/+subscriptions

-- 
Mailing list: https://launchpad.net/~yahoo-eng-team
Post to : yahoo-eng-team@lists.launchpad.net
Unsubscribe : https://launchpad.net/~yahoo-eng-team
More help   : https://help.launchpad.net/ListHelp

[Yahoo-eng-team] [Bug 1322197] Re: [OSSA 2014-023] Persistent XSS in OpenStack Havana UI for Network Name (CVE-2014-3474)

2014-07-09 Thread Tristan Cacqueray

** Changed in: ossa
   Status: Fix Committed => Fix Released

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Dashboard (Horizon).
https://bugs.launchpad.net/bugs/1322197

Title:
  [OSSA 2014-023] Persistent XSS in OpenStack Havana UI for Network Name
  (CVE-2014-3474)

Status in OpenStack Dashboard (Horizon):
  Fix Committed
Status in OpenStack Security Advisories:
  Fix Released

Bug description:
  Received 2014-05-20 18:52:34 UTC via encrypted E-mail from "Craig
  Lorentzen (crlorent)" :

  Hello Jeremy,

  This is Craig Lorentzen from the Product Security Incident Response Team
  (PSIRT) at Cisco Systems. The purpose of this email is to disclose to
  you a vulnerability that was found during testing of a Cisco Product
  using OpenStack.  Below please find the original discoverer's notes.
  Please let us know if there is anything else you need regarding this.
  Please also provide a tracking number for our records.

  -

  Headline: Persistent XSS in OpenStack Havana UI for Network Name
  Platforms:OpenStack Horizon
  Versions: Havana
  CVSS Score:   9.0
  CVSS Vector:  AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:U/RC:C
  CWE Tags:

  The Openstack Horizon user interface is vulnerable to XSS.  The Network Name
  parameter is not properly sanitized to prevent javascript injection, leading
  to persistent XSS.

  Steps to reproduce:

  1) Create a new network.  Use:

  alert(1);

  for the network name.  Disable both Subnet -> Create Subnet and Subnet Detail 
->
  Enable DHCP.  Choose Create.

  2) Select Instances -> Launch Instance.  Receive alert.

  Recommendations:

  - Sanitize the rendering of "Network Name" string to prevent XSS.

  - Consider utilizing Content Security Policy (CSP). This can be used to 
prevent
  inline javascript from executing & only load Javascript files from approved
  domains.  This would prevent XSS, even in scenarios where user input is not
  properly sanitized.

  -

  Thank You,
  Craig Lorentzen
  Incident Manager
  Cisco Product Security Incident Response Team
  Security Research and Operations
  Office: 919.574.5680
  Email: crlor...@cisco.com
  SIO: http://www.cisco.com/security
  PGP: 0x30A6C8ED

To manage notifications about this bug go to:
https://bugs.launchpad.net/horizon/+bug/1322197/+subscriptions

-- 
Mailing list: https://launchpad.net/~yahoo-eng-team
Post to : yahoo-eng-team@lists.launchpad.net
Unsubscribe : https://launchpad.net/~yahoo-eng-team
More help   : https://help.launchpad.net/ListHelp

[Yahoo-eng-team] [Bug 1320235] Re: [OSSA 2014-023] Stored XSS for /admin/users/ (CVE-2014-3475)

2014-07-09 Thread Tristan Cacqueray

** Changed in: ossa
   Status: Fix Committed => Fix Released

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Dashboard (Horizon).
https://bugs.launchpad.net/bugs/1320235

Title:
  [OSSA 2014-023] Stored XSS for /admin/users/ (CVE-2014-3475)

Status in OpenStack Dashboard (Horizon):
  Fix Committed
Status in OpenStack Security Advisories:
  Fix Released

Bug description:
  The /admin/users/ page does not output encode users' email addresses
  correctly. Since there is  no user input validation for the users'
  email address during creation process. It is possible to inject script
  tag into the email address. This is a stored cross site scripting
  issue.

  The issue can be abused to hijack user's session and implant malware,
  etc.

  
  For example, attached is a screen copy of Horizon for users with stored XSS 
in action.

To manage notifications about this bug go to:
https://bugs.launchpad.net/horizon/+bug/1320235/+subscriptions

-- 
Mailing list: https://launchpad.net/~yahoo-eng-team
Post to : yahoo-eng-team@lists.launchpad.net
Unsubscribe : https://launchpad.net/~yahoo-eng-team
More help   : https://help.launchpad.net/ListHelp

[Yahoo-eng-team] [Bug 1270725] Re: Quota Deadlock when creating >200 servers at once under Psql

2014-07-09 Thread Victor Sergeyev

** Changed in: oslo
   Status: Fix Committed => Fix Released

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Compute (nova).
https://bugs.launchpad.net/bugs/1270725

Title:
  Quota Deadlock when creating >200 servers at once under Psql

Status in OpenStack Compute (Nova):
  In Progress
Status in Oslo - a Library of Common OpenStack Code:
  Fix Released

Bug description:
  When you create >200 servers at once under psql, 
it's easier to meet a deadlock exception in quota process(reserve/commit).

  Like this:
  http://paste.openstack.org/show/61534/

  The '@retry_on_dead_lock' function, is not available for matching
  psql.

To manage notifications about this bug go to:
https://bugs.launchpad.net/nova/+bug/1270725/+subscriptions

-- 
Mailing list: https://launchpad.net/~yahoo-eng-team
Post to : yahoo-eng-team@lists.launchpad.net
Unsubscribe : https://launchpad.net/~yahoo-eng-team
More help   : https://help.launchpad.net/ListHelp

[Yahoo-eng-team] [Bug 1252693] Re: Running of unit tests fails if SQLAlchemy >= 0.8.3 is used

2014-07-09 Thread Victor Sergeyev

** Changed in: oslo
Status: Fix Committed => Fix Released

--
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Compute (nova).
https://bugs.launchpad.net/bugs/1252693

Title:
Running of unit tests fails if SQLAlchemy >= 0.8.3 is used

Status in OpenStack Compute (Nova):
Fix Released
Status in Oslo - a Library of Common OpenStack Code:
Fix Released

Bug description:
If SQLAlchemy >= 0.8.3 is used, running of unit tests fails. The
following error is printed to stderr multiple times:

DBError: (IntegrityError) constraint failed u'UPDATE
instance_system_metadata SET updated_at=?, deleted_at=?, deleted=?
WHERE instance_system_metadata.id = ?' ('2013- 11-19
10:37:44.378444', '2013-11-19 10:37:44.377819', 11, 11)

A few of our migrations change the type of deleted column from boolean
to int. MySQL and SQLite don't have native boolean data type.
SQLAlchemy uses int columns (e.g. in case of MySQL - tinyint) + CHECK
constraint (something like CHECK (deleted in (0, 1))) to emulate
boolean data type.

In our migrations when the type of column `deleted` is changed from
boolean to int, the corresponding CHECK constraint is dropped too. But
starting from SQLAlchemy version 0.8.3, those CHECK constraints aren't
dropped anymore. So despite the fact that column deleted is of type
int now, we still restrict its values to be either 0 or 1.

Migrations changing the data type of deleted columns rely on SQL
rendered for CHECK constraints (e.g.

https://github.com/openstack/nova/blob/master/nova/db/sqlalchemy/migrate_repo/versions/152_change_type_of_deleted_column.py#L172).
There was a patch in SQLAlchemy 0.8.3 release that slightly changed
the way DDL statements are rendered
((http://docs.sqlalchemy.org/en/latest/changelog/changelog_08.html
#change-487183f04e6da9aa27d8817bca9906d1)). Unfortunately, due to the
fact that nova migrations depend on such implementation details, this
change to SQLAlchemy broke our code.

We must fix our migrations to work properly with new SQLAlchemy
versions too (0.8.3+).

To manage notifications about this bug go to:
https://bugs.launchpad.net/nova/+bug/1252693/+subscriptions

--
Mailing list: https://launchpad.net/~yahoo-eng-team
Post to : yahoo-eng-team@lists.launchpad.net
Unsubscribe : https://launchpad.net/~yahoo-eng-team
More help : https://help.launchpad.net/ListHelp

[Yahoo-eng-team] [Bug 1339735] [NEW] Deadlock updating image properties in glance-registry daemon

2014-07-09 Thread Sean Dague

Public bug reported:

Glance Registry is now regularly deadlocking when trying to update image
properties. This causes gate failures.

Example Log: http://logs.openstack.org/33/100933/3/gate/gate-tempest-
dsvm-full/e21d71a/logs/screen-g-reg.txt.gz#_2014-07-09_00_27_38_261

Logstash query: message:'Deadlock found when trying to get lock; try
restarting transaction' AND tags:screen-g-reg.txt

** Affects: glance
 Importance: High
 Status: New

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to Glance.
https://bugs.launchpad.net/bugs/1339735

Title:
  Deadlock updating image properties in glance-registry daemon

Status in OpenStack Image Registry and Delivery Service (Glance):
  New

Bug description:
  Glance Registry is now regularly deadlocking when trying to update
  image properties. This causes gate failures.

  Example Log: http://logs.openstack.org/33/100933/3/gate/gate-tempest-
  dsvm-full/e21d71a/logs/screen-g-reg.txt.gz#_2014-07-09_00_27_38_261

  Logstash query: message:'Deadlock found when trying to get lock; try
  restarting transaction' AND tags:screen-g-reg.txt

To manage notifications about this bug go to:
https://bugs.launchpad.net/glance/+bug/1339735/+subscriptions

-- 
Mailing list: https://launchpad.net/~yahoo-eng-team
Post to : yahoo-eng-team@lists.launchpad.net
Unsubscribe : https://launchpad.net/~yahoo-eng-team
More help   : https://help.launchpad.net/ListHelp

[Yahoo-eng-team] [Bug 1339739] [NEW] test_cidr_repr race fail with "AttributeError: 'PostgreSQLOpportunisticFixture' object has no attribute '_details'"

2014-07-09 Thread Matt Riedemann

Public bug reported:

message:"AttributeError: 'PostgreSQLOpportunisticFixture' object has no
attribute '_details'" AND tags:console AND project:"openstack/nova"

http://logstash.openstack.org/#eyJzZWFyY2giOiJtZXNzYWdlOlwiQXR0cmlidXRlRXJyb3I6ICdQb3N0Z3JlU1FMT3Bwb3J0dW5pc3RpY0ZpeHR1cmUnIG9iamVjdCBoYXMgbm8gYXR0cmlidXRlICdfZGV0YWlscydcIiBBTkQgdGFnczpjb25zb2xlIEFORCBwcm9qZWN0Olwib3BlbnN0YWNrL25vdmFcIiIsImZpZWxkcyI6W10sIm9mZnNldCI6MCwidGltZWZyYW1lIjoiNjA0ODAwIiwiZ3JhcGhtb2RlIjoiY291bnQiLCJ0aW1lIjp7InVzZXJfaW50ZXJ2YWwiOjB9LCJzdGFtcCI6MTQwNDkxNjY0NDYxMywibW9kZSI6IiIsImFuYWx5emVfZmllbGQiOiIifQ==

** Affects: nova
 Importance: Undecided
 Status: New


** Tags: db testing

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Compute (nova).
https://bugs.launchpad.net/bugs/1339739

Title:
  test_cidr_repr race fail with "AttributeError:
  'PostgreSQLOpportunisticFixture' object has no attribute '_details'"

Status in OpenStack Compute (Nova):
  New

Bug description:
  message:"AttributeError: 'PostgreSQLOpportunisticFixture' object has
  no attribute '_details'" AND tags:console AND project:"openstack/nova"

  
http://logstash.openstack.org/#eyJzZWFyY2giOiJtZXNzYWdlOlwiQXR0cmlidXRlRXJyb3I6ICdQb3N0Z3JlU1FMT3Bwb3J0dW5pc3RpY0ZpeHR1cmUnIG9iamVjdCBoYXMgbm8gYXR0cmlidXRlICdfZGV0YWlscydcIiBBTkQgdGFnczpjb25zb2xlIEFORCBwcm9qZWN0Olwib3BlbnN0YWNrL25vdmFcIiIsImZpZWxkcyI6W10sIm9mZnNldCI6MCwidGltZWZyYW1lIjoiNjA0ODAwIiwiZ3JhcGhtb2RlIjoiY291bnQiLCJ0aW1lIjp7InVzZXJfaW50ZXJ2YWwiOjB9LCJzdGFtcCI6MTQwNDkxNjY0NDYxMywibW9kZSI6IiIsImFuYWx5emVfZmllbGQiOiIifQ==

To manage notifications about this bug go to:
https://bugs.launchpad.net/nova/+bug/1339739/+subscriptions

-- 
Mailing list: https://launchpad.net/~yahoo-eng-team
Post to : yahoo-eng-team@lists.launchpad.net
Unsubscribe : https://launchpad.net/~yahoo-eng-team
More help   : https://help.launchpad.net/ListHelp

[Yahoo-eng-team] [Bug 1339760] [NEW] Launch instance: volume device name should be optional

2014-07-09 Thread Julie Pichon

Public bug reported:

>From comment 9 on Nova bug 1337821, the device name should be optional
and can cause issues if we force the user to select one and they enter
an incorrect value. We should make the field optional (and make sure we
still create the instance correctly in these cases.)

** Affects: horizon
 Importance: Medium
 Status: New


** Tags: nova

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Dashboard (Horizon).
https://bugs.launchpad.net/bugs/1339760

Title:
  Launch instance: volume device name should be optional

Status in OpenStack Dashboard (Horizon):
  New

Bug description:
  From comment 9 on Nova bug 1337821, the device name should be optional
  and can cause issues if we force the user to select one and they enter
  an incorrect value. We should make the field optional (and make sure
  we still create the instance correctly in these cases.)

To manage notifications about this bug go to:
https://bugs.launchpad.net/horizon/+bug/1339760/+subscriptions

-- 
Mailing list: https://launchpad.net/~yahoo-eng-team
Post to : yahoo-eng-team@lists.launchpad.net
Unsubscribe : https://launchpad.net/~yahoo-eng-team
More help   : https://help.launchpad.net/ListHelp

[Yahoo-eng-team] [Bug 1339775] [NEW] Some v2 exceptions raise unicodeError

2014-07-09 Thread Stuart McLaren

Public bug reported:

In v2, for some exceptions the exception is not converted to a string
properly resulting in:

2014-07-09 15:36:38,714 INFO msg = _("Image exceeds the storage quota: %s") % e
2014-07-09 15:36:38,714 INFO File "glance/openstack/common/gettextutils.py", 
line 333, in __str__
2014-07-09 15:36:38,714 INFO raise UnicodeError(msg)

in some cases 'utils.exception_to_str' is used to cast the exception.

We should do this in all cases for consistency/to avoid the stack trace

** Affects: glance
 Importance: Undecided
 Status: New

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to Glance.
https://bugs.launchpad.net/bugs/1339775

Title:
  Some v2 exceptions raise unicodeError

Status in OpenStack Image Registry and Delivery Service (Glance):
  New

Bug description:
  In v2, for some exceptions the exception is not converted to a string
  properly resulting in:

  2014-07-09 15:36:38,714 INFO msg = _("Image exceeds the storage quota: %s") % 
e
  2014-07-09 15:36:38,714 INFO File "glance/openstack/common/gettextutils.py", 
line 333, in __str__
  2014-07-09 15:36:38,714 INFO raise UnicodeError(msg)

  in some cases 'utils.exception_to_str' is used to cast the exception.

  We should do this in all cases for consistency/to avoid the stack
  trace

To manage notifications about this bug go to:
https://bugs.launchpad.net/glance/+bug/1339775/+subscriptions

-- 
Mailing list: https://launchpad.net/~yahoo-eng-team
Post to : yahoo-eng-team@lists.launchpad.net
Unsubscribe : https://launchpad.net/~yahoo-eng-team
More help   : https://help.launchpad.net/ListHelp

[Yahoo-eng-team] [Bug 1339789] [NEW] Horizon should redirect to the last used window after using Setting or Change Password

2014-07-09 Thread Ido Ovadia

Public bug reported:

Description of problem:
===
Horizon should redirect to the last used window after using 'Setting' or 
'Change Password'

Version-Release number of selected component:
=
openstack-dashboard-2014.1-7.el7ost.noarch


How reproducible:
=
100%

Steps to Reproduce:
===
Change settings or password

Actual results:
===
Horizons doesn't redirect to the last used window

Expected results:
=
After click 'Save' or 'Change' Horizon should redirect to the last used window

** Affects: horizon
 Importance: Undecided
 Status: New


** Tags: ux

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Dashboard (Horizon).
https://bugs.launchpad.net/bugs/1339789

Title:
   Horizon should redirect to the last used window after using Setting
  or Change Password

Status in OpenStack Dashboard (Horizon):
  New

Bug description:
  Description of problem:
  ===
  Horizon should redirect to the last used window after using 'Setting' or 
'Change Password'

  Version-Release number of selected component:
  =
  openstack-dashboard-2014.1-7.el7ost.noarch

  
  How reproducible:
  =
  100%

  Steps to Reproduce:
  ===
  Change settings or password

  Actual results:
  ===
  Horizons doesn't redirect to the last used window

  Expected results:
  =
  After click 'Save' or 'Change' Horizon should redirect to the last used window

To manage notifications about this bug go to:
https://bugs.launchpad.net/horizon/+bug/1339789/+subscriptions

-- 
Mailing list: https://launchpad.net/~yahoo-eng-team
Post to : yahoo-eng-team@lists.launchpad.net
Unsubscribe : https://launchpad.net/~yahoo-eng-team
More help   : https://help.launchpad.net/ListHelp

[Yahoo-eng-team] [Bug 1333587] Re: VMware: ExtendVirtualDisk_Task fails due to locked file

2014-07-09 Thread Tracy Jones

** Also affects: openstack-vmwareapi-team
   Importance: Undecided
   Status: New

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Compute (nova).
https://bugs.launchpad.net/bugs/1333587

Title:
  VMware: ExtendVirtualDisk_Task fails due to locked file

Status in OpenStack Compute (Nova):
  Fix Committed
Status in The OpenStack VMwareAPI subTeam:
  New

Bug description:
  Extending a disk during spawn races, which can result in failure. It
  is possible to hit this bug by launching a large number of instances
  of an image which isn't already cached, simultaneously. Some of them
  will race to extend the cached image, ultimately resulting in an error
  such as:

  2014-06-17 10:49:26.006 9177 WARNING nova.virt.vmwareapi.driver [-] Task 
[ExtendVirtualDisk_Task] 
 value = "task-12073"
 _type = "Task"
   } status: error Unable to access file [datastore1] 
172.16.0.13_base/326153d2-1226-415a-a194-2ca47ac3c48b/326153d2-1226-415a-a194-2ca47ac3c48b.1.vmdk
 since it is locked

To manage notifications about this bug go to:
https://bugs.launchpad.net/nova/+bug/1333587/+subscriptions

-- 
Mailing list: https://launchpad.net/~yahoo-eng-team
Post to : yahoo-eng-team@lists.launchpad.net
Unsubscribe : https://launchpad.net/~yahoo-eng-team
More help   : https://help.launchpad.net/ListHelp

74 matches

Mail list logo