Bug 1383421

Summary:	[CVE-2015-5162] oslo.concurrency: Backport support for 'prlimit' parameter [OSP-6]
Product:	Red Hat OpenStack	Reporter:	Eric Harney <eharney>
Component:	python-oslo-concurrency	Assignee:	Victor Stinner <vstinner>
Status:	CLOSED NOTABUG	QA Contact:	Shai Revivo <srevivo>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	6.0 (Juno)	CC:	apevec, dcadzow, eharney, kchamart, lhh, pgrist, srevivo, vstinner
Target Milestone:	---	Keywords:	FeatureBackport, ZStream
Target Release:	6.0 (Juno)
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	qemu-img calls were unrestricted by ulimit. This caused a security vulnerability (CVE-2015-5162) in Nova. The new minor version of oslo.concurrency adds support for process limits ('prlimit'), needed to fix the security vulnerability.	Story Points:	---
Clone Of:	1383415	Environment:
Last Closed:	2016-10-31 17:08:14 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Bug Depends On:	1383415, 1384855
Bug Blocks:	1382551, 1382569

Description Eric Harney 2016-10-10 14:51:51 UTC

+++ This bug was initially created as a clone of Bug #1383415 +++

Security fixes in Nova, Cinder, and Glance require support for prlimit in oslo.concurrency.

The following changes need to be backported:

d65d931 processutils: add support for missing process limits
e33f64f Add prlimit parameter to execute()

Comment 1 Victor Stinner 2016-10-14 13:52:56 UTC

Note: python-oslo-concurrency-1.8.2-2.el7ost is the same package for OSP 6 and OSP 7, since both OSP versions are based on oslo.concurrency 1.8.2.

Comment 3 Lon Hohberger 2016-10-31 16:01:01 UTC

python-oslo-concurrency was NOT shipped in RHEL OSP 6.

Comment 5 Lon Hohberger 2016-10-31 16:03:10 UTC

What is the expected outcome here?  There's no python-oslo-concurrency package in RHEL OSP 6.

Comment 6 Eric Harney 2016-10-31 17:08:14 UTC

I misreported this bug against OSP6, nothing is needed here.