openstack-announce

[openstack-announce] OpenStack 2026.1 "Gazpacho" is officially released!

Wed, 01 Apr 2026 14:58:59 GMT

2026/04/01 -- Elõd Illés

[openstack-announce] [all][elections][ptl] 2026.2 Hibiscus: PTL Election Conclusion and Results

Fri, 20 Mar 2026 18:47:11 GMT

2026/03/20 -- Ian Y. Choi

[openstack-announce] [OSSA-2026-004] Glance: Server-Side Request Forgery (SSRF) vulnerabilities in OpenStack Glance image import functionality (CVE-2026-pending)

Thu, 19 Mar 2026 15:14:58 GMT

2026/03/19 -- Brian Rosmaita

[openstack-announce] [OSSA-2026-003] OpenStack Vitrage: Remote code execution through Vitrage query parser (CVE-2026-28370)

Tue, 03 Mar 2026 17:42:46 GMT

2026/03/03 -- Jeremy Stanley

[openstack-announce] [all][elections][tc] 2026.2 Hibiscus Technical Committee Election Results

Thu, 26 Feb 2026 19:59:54 GMT

2026/02/26 -- Ian Y. Choi

[openstack-announce] [OSSA-2026-002] OpenStack Nova: calls qemu-img without format restrictions for resize (CVE-2026-24708) errata 1

Tue, 17 Feb 2026 18:00:56 GMT

2026/02/17 -- Jeremy Stanley

[openstack-announce] [OSSA-2026-002] OpenStack Nova: calls qemu-img without format restrictions for resize (CVE-2026-24708)

Tue, 17 Feb 2026 15:01:07 GMT

2026/02/17 -- Jeremy Stanley

[openstack-announce] [OSSA-2026-001] OpenStack keystonemiddleware: Privilege Escalation via Identity Headers in External OAuth2 Tokens (CVE-2026-22797) errata 1

Fri, 16 Jan 2026 23:35:56 GMT

2026/01/16 -- Jeremy Stanley

[openstack-announce] [CVE-2026-22797] OpenStack keystonemiddleware: Privilege Escalation via Identity Headers in External OAuth2 Tokens (CVE-2026-22797)

Thu, 15 Jan 2026 15:32:58 GMT

2026/01/15 -- Jeremy Stanley

[openstack-announce] [OSSA-2025-002] OpenStack Keystone: Unauthenticated access to EC2/S3 token endpoints can grant Keystone authorization (CVE-2025-65073)

Mon, 17 Nov 2025 20:13:44 GMT

2025/11/17 -- Jeremy Stanley

[openstack-announce] [OSSA-2025-002] OpenStack Keystone: Unauthenticated access to EC2/S3 token endpoints can grant Keystone authorization (CVE PENDING)

Tue, 04 Nov 2025 15:01:19 GMT

2025/11/04 -- Jeremy Stanley

[openstack-announce] OpenStack 2025.2 "Flamingo" is officially released!

Sat, 18 Oct 2025 00:59:13 GMT

2025/10/18 -- Elõd Illés

[openstack-announce] [all][elections][tc] 2026.1 Gazpacho Technical Committee Election Results

Thu, 18 Sep 2025 21:15:15 GMT

2025/09/18 -- Sławek Kapłoński

[openstack-announce] [all][elections][ptl] 2026.1 Gazpacho: PTL Election Conclusion & Results

Thu, 18 Sep 2025 14:51:10 GMT

2025/09/18 -- Sławek Kapłoński

[openstack-announce] OSSN-0094: Ensuring Volume Safety with Nova and Watcher

Wed, 20 Aug 2025 19:40:10 GMT

2025/08/20 -- Jay Faulkner

[openstack-announce] [administrivia] Messages accidentally approved through moderation

Tue, 20 May 2025 16:13:48 GMT

2025/05/20 -- Jeremy Stanley

[openstack-announce] [Patch Management] [Openstack-2024.1 (caracal)]

Tue, 20 May 2025 16:12:17 GMT

2025/05/20 -- Shalini Srivastava

[openstack-announce] Guidance related to [Patch Management] [Openstack-2024.1 (caracal)]

Tue, 20 May 2025 16:03:15 GMT

2025/05/20 -- Shalini Srivastava

[openstack-announce] [OSSA-2025-001] Ironic fails to restrict paths used for file:// image URLs (CVE-2025-44021)

Thu, 08 May 2025 15:30:12 GMT

2025/05/08 -- Jay Faulkner

[openstack-announce] OpenStack 2025.1 Epoxy is officially released!

Wed, 02 Apr 2025 14:45:39 GMT

2025/04/02 -- Elõd Illés

[openstack-announce] [OSSA-2024-005] Neutron: Authorization bypassed when setting tags on Neutron networks (CVE-2024-53916)

Tue, 03 Dec 2024 23:14:41 GMT

2024/12/03 -- Jay Faulkner

[openstack-announce] [OSSA-2024-004]: OpenStack Ironic fails to verify checksums of supplied image_source URLs when configured to convert images to raw for streaming

Thu, 03 Oct 2024 15:50:53 GMT

2024/10/03 -- Jay Faulkner

[openstack-announce] OpenStack 2024.2 Dalmatian is officially released!

Wed, 02 Oct 2024 14:29:12 GMT

2024/10/02 -- Elõd Illés

[openstack-announce] [all][elections][tc][ptl] 2025.1 Epoxy: Technical Committee & PTL Election Conclusion & Results

Thu, 19 Sep 2024 15:09:55 GMT

2024/09/19 -- Ian Y. Choi

[openstack-announce] [OSSA-2024-003] OpenStack Ironic: Unvalidated image data passed to qemu-img (CVE-2024-44082)

Wed, 04 Sep 2024 15:49:55 GMT

2024/09/04 -- Brian Rosmaita

[openstack-announce] [OSSA-2024-002] OpenStack Nova: Incomplete file access fix and regression for QCOW2 backing files and VMDK flat descriptors (CVE-2024-40767)

Tue, 23 Jul 2024 15:01:00 GMT

2024/07/23 -- Jeremy Stanley

[openstack-announce] [OSSA-2024-001] OpenStack Cinder, Glance, Nova: Arbitrary file access through custom QCOW2 external data (CVE-2024-32498)

Tue, 02 Jul 2024 15:01:30 GMT

2024/07/02 -- Jeremy Stanley

[openstack-announce] [all][elections][tc] 2024.2 Dalmatian Technical Committee Election Results

Thu, 04 Apr 2024 21:10:32 GMT

2024/04/04 -- Ian Y. Choi

[openstack-announce] OpenStack 2024.1 Caracal is officially released!

Wed, 03 Apr 2024 15:17:41 GMT

2024/04/03 -- Elõd Illés

[openstack-announce] [all][elections][ptl] 2024.2 Dalmatian: PTL Election Conclusion & Results

Mon, 25 Mar 2024 13:11:41 GMT

2024/03/25 -- Ian Y. Choi

[openstack-announce] OSSN-0093: [Murano] Unsafe Environment Handling in MuranoPL

Thu, 14 Mar 2024 20:33:47 GMT

2024/03/14 -- Jeremy Stanley

[openstack-announce] OSSN-0093: Unresolved Vulnerability in OpenStack Murano

Thu, 07 Mar 2024 22:51:24 GMT

2024/03/07 -- Jeremy Stanley

[openstack-announce] OpenStack 2023.2 Bobcat is officially released!

Wed, 04 Oct 2023 14:23:50 GMT

2023/10/04 -- Herve Beraud

[openstack-announce] [all][elections][ptl] Project Team Lead Election Conclusion and Results

Thu, 21 Sep 2023 00:34:10 GMT

2023/09/21 -- Tony Breeds

[openstack-announce] [all][elections][tc] Technical Committee Election Results

Thu, 21 Sep 2023 00:33:22 GMT

2023/09/21 -- Tony Breeds

[openstack-announce] [OSSA-2023-003] cinder, glance_store, nova, os-brick: Unauthorized volume access through deleted volume attachments (CVE-2023-2088)

Wed, 10 May 2023 17:38:33 GMT

2023/05/10 -- Jeremy Stanley

Re: [openstack-announce] [ptl][tc][winstackers] Final call for Winstackers PTL and maintainers

Mon, 17 Apr 2023 15:45:35 GMT

2023/04/17 -- Ghanshyam Mann

[openstack-announce] [all][tc][vitrage] Final call for Vitrage project maintainers

Mon, 17 Apr 2023 15:44:40 GMT

2023/04/17 -- Ghanshyam Mann

[openstack-announce] OpenStack 2023.1 Antelope is officially released!

Wed, 22 Mar 2023 15:32:16 GMT

2023/03/22 -- Elõd Illés

[openstack-announce] [all][elections][tc][ptl] 2023.2 Bobcat: Technical Committee & PTL Election Conclusion & Results

Mon, 27 Feb 2023 14:54:32 GMT

2023/02/27 -- Ian Y. Choi

[openstack-announce] [OSSA-2023-002] Cinder, Glance, Nova: Arbitrary file access through custom VMDK flat descriptor (CVE-2022-47951)

Tue, 24 Jan 2023 16:25:37 GMT

2023/01/24 -- Jeremy Stanley

[openstack-announce] [OSSA-2023-001] Swift: Arbitrary file access through custom S3 XML entities (CVE-2022-47950)

Tue, 17 Jan 2023 16:15:14 GMT

2023/01/17 -- Jeremy Stanley

[openstack-announce] [OSSN-0091] BMC emulators developed in OpenStack community do not preserve passwords on VMs

Mon, 31 Oct 2022 21:41:14 GMT

2022/10/31 -- Jay Faulkner

[openstack-announce] [0SSN-0090] Best practices when configuring Glance with COW backends

Mon, 17 Oct 2022 15:47:34 GMT

2022/10/17 -- Brian Rosmaita

[openstack-announce] OpenStack Zed is officially released!

Wed, 05 Oct 2022 15:12:31 GMT

2022/10/05 -- Előd Illés

Re: [openstack-announce] [all][elections][tc][ptl] Antelope: Technical Committee & PTL Election Conclusion & Results

Tue, 20 Sep 2022 15:52:04 GMT

2022/09/20 -- Ian Y. Choi

[openstack-announce] OpenStack Yoga is officially released!

Wed, 30 Mar 2022 15:07:24 GMT

2022/03/30 -- Előd Illés

[openstack-announce] [all][elections][ptl] Project Team Lead Zed Election Conclusion and Results

Fri, 25 Feb 2022 14:31:44 GMT

2022/02/25 -- Ghanshyam Mann

[openstack-announce] [all][elections][tc] Technical Committee Election Results

Fri, 25 Feb 2022 14:31:31 GMT

2022/02/25 -- Ghanshyam Mann

[openstack-announce] OpenStack Xena is officially released!

Wed, 06 Oct 2021 14:43:27 GMT

2021/10/06 -- Herve Beraud

[openstack-announce] [OSSA-2021-002] Nova: Open Redirect in noVNC proxy (CVE-2021-3654)

Mon, 27 Sep 2021 17:27:13 GMT

2021/09/27 -- Jeremy Stanley

[openstack-announce] [OSSA-2021-006] Neutron: Routes middleware memory leak for nonexistent controllers (CVE-2021-40797)

Thu, 09 Sep 2021 14:14:13 GMT

2021/09/09 -- Jeremy Stanley

[openstack-announce] [all][elections][ptl] Project Team Lead Election Conclusion and Results

Wed, 08 Sep 2021 14:05:06 GMT

2021/09/08 -- Ian Y. Choi

[openstack-announce] [OSSA-2021-005] Neutron: Arbitrary dnsmasq reconfiguration via extra_dhcp_opts (CVE-2021-40085)

Tue, 31 Aug 2021 15:09:27 GMT

2021/08/31 -- Jeremy Stanley

[openstack-announce] [OSSA-2021-004] Neutron: Linuxbridge ARP filter bypass on Netfilter platforms (CVE-2021-38598)

Tue, 17 Aug 2021 15:21:14 GMT

2021/08/17 -- Jeremy Stanley

[openstack-announce] [OSSA-2021-003] Keystone: Account name and UUID oracles in account locking (CVE-2021-38155)

Tue, 10 Aug 2021 14:59:48 GMT

2021/08/10 -- Jeremy Stanley

[openstack-announce] [OSSA-2021-002] Nova: Open Redirect in noVNC proxy (CVE-2021-3654)

Thu, 29 Jul 2021 17:40:39 GMT

2021/07/29 -- Jeremy Stanley

[openstack-announce] [OSSA-2021-001] Neutron: Anti-spoofing bypass for Open vSwitch networks (CVE-2021-20267)

Mon, 12 Jul 2021 19:24:40 GMT

2021/07/12 -- Jeremy Stanley

[openstack-announce] OpenStack Wallaby is officially released!

Wed, 14 Apr 2021 15:35:20 GMT

2021/04/14 -- Herve Beraud

[openstack-announce] [OSSN-0089] Missing configuration option in Secure Live Migration guide leads to unencrypted traffic

Tue, 13 Apr 2021 13:45:35 GMT

2021/04/13 -- Josephine Seifert

[openstack-announce] [OSSN-0088] Some of the Glance metadef APIs likely to leak resources

Tue, 09 Mar 2021 15:28:25 GMT

2021/03/09 -- Abhishek Kekane

[openstack-announce] [OSSN-0087] Ceph user credential leakage to consumers of OpenStack Manila

Thu, 17 Dec 2020 16:41:45 GMT

2020/12/17 -- gouthampravi

[openstack-announce] [OSSA-2020-008] horizon: Open redirect in workflow forms (CVE-2020-29565)

Mon, 07 Dec 2020 23:45:16 GMT

2020/12/07 -- Gage Hugo

[openstack-announce] [OSSA-2020-007] Blazar: Remote code execution in blazar-dashboard (CVE-2020-26943)

Fri, 16 Oct 2020 17:21:18 GMT

2020/10/16 -- Pierre Riteau

[openstack-announce] OpenStack Victoria is officially released!

Wed, 14 Oct 2020 14:40:09 GMT

2020/10/14 -- Sean McGinnis

[openstack-announce] [all][elections][ptl] Project Team Lead Election Conclusion and Results

Wed, 14 Oct 2020 00:42:20 GMT

2020/10/14 -- Jeremy Stanley

[openstack-announce] [all][elections][tc] Technical Committee Election Results

Wed, 14 Oct 2020 00:41:03 GMT

2020/10/14 -- Jeremy Stanley

[openstack-announce] [OSSA-2020-006] Nova: Live migration fails to update persistent domain XML (CVE-2020-17376)

Tue, 25 Aug 2020 16:39:26 GMT

2020/08/25 -- Jeremy Stanley

[openstack-announce] [OSSN-0086] erratum: Dell EMC ScaleIO/VxFlex OS Backend Credentials Exposure

Thu, 18 Jun 2020 21:47:23 GMT

2020/06/18 -- Brian Rosmaita

[openstack-announce] [OSSN-0086] Dell EMC ScaleIO/VxFlex OS Backend Credentials Exposure

Wed, 03 Jun 2020 16:27:23 GMT

2020/06/03 -- Brian Rosmaita

[openstack-announce] OpenStack Ussuri is officially released!

Wed, 13 May 2020 14:56:23 GMT

2020/05/13 -- Sean McGinnis

Re: [openstack-announce] [OSSA-2020-004] Keystone: Keystone credential endpoints allow owner modification and are not protected from a scoped context (CVE PENDING)

Thu, 07 May 2020 21:29:09 GMT

2020/05/07 -- Gage Hugo

Re: [openstack-announce] [OSSA-2020-003] Keystone: Keystone does not check signature TTL of the EC2 credential auth method (CVE PENDING)

Thu, 07 May 2020 21:24:08 GMT

2020/05/07 -- Gage Hugo

Re: [openstack-announce] [OSSA-2020-005] Keystone: OAuth1 request token authorize silently ignores roles parameter (CVE PENDING)

Thu, 07 May 2020 21:24:08 GMT

2020/05/07 -- Gage Hugo

[openstack-announce] [OSSA-2020-003] Keystone: Keystone does not check signature TTL of the EC2 credential auth method (CVE PENDING)

Wed, 06 May 2020 20:59:25 GMT

2020/05/06 -- Gage Hugo

[openstack-announce] [OSSA-2020-005] Keystone: OAuth1 request token authorize silently ignores roles parameter (CVE PENDING)

Wed, 06 May 2020 20:57:24 GMT

2020/05/06 -- Gage Hugo

[openstack-announce] [OSSA-2020-004] Keystone: Keystone credential endpoints allow owner modification and are not protected from a scoped context (CVE PENDING)

Wed, 06 May 2020 20:57:19 GMT

2020/05/06 -- Gage Hugo

[openstack-announce] [OSSA-2020-002] Manila: Unprivileged users can retrieve, use and manipulate share networks (CVE-2020-9543)

Thu, 12 Mar 2020 22:19:12 GMT

2020/03/12 -- Goutham Pacha Ravi

[openstack-announce] [OSSA-2020-001] Nova can leak consoleauth token into log files (CVE-2015-9543)

Wed, 19 Feb 2020 17:28:27 GMT

2020/02/19 -- Jeremy Stanley

[openstack-announce] [OSSA-2019-006] Credentials API allows listing and retrieving of all users credentials (CVE-2019-19687)

Wed, 11 Dec 2019 18:50:04 GMT

2019/12/11 -- Gage Hugo

[openstack-announce] [OSSN-0085] Cinder configuration option can leak secret key from Ceph backend

Thu, 05 Dec 2019 17:21:22 GMT

2019/12/05 -- Brian Rosmaita

[openstack-announce] OpenStack Train is officially released!

Wed, 16 Oct 2019 14:36:28 GMT

2019/10/16 -- Sean McGinnis

[openstack-announce] [OSSA-2019-005] Octavia Amphora-Agent not requiring Client-Certificate (CVE-2019-17134)

Tue, 08 Oct 2019 13:12:18 GMT

2019/10/08 -- Daniel 'f0o' Preussker

[openstack-announce] [all][elections][ptl] Combined Project Team Lead and Technical Committee Election Conclusion and Results

Wed, 04 Sep 2019 03:00:13 GMT

2019/09/04 -- Jeremy Stanley

[openstack-announce] [OSSA-2019-004] Ageing time of 0 disables linuxbridge MAC learning (CVE-2019-15753)

Thu, 29 Aug 2019 14:54:49 GMT

2019/08/29 -- Jeremy Stanley

[openstack-announce] [OSSA-2019-003] Nova Server Resource Faults Leak External Exception Details (CVE-2019-14433)

Thu, 08 Aug 2019 15:07:20 GMT

2019/08/08 -- Jeremy Stanley

[openstack-announce] OpenStack Stein is officially released!

Wed, 10 Apr 2019 14:54:26 GMT

2019/04/10 -- Sean McGinnis

[openstack-announce] [OSSA-2019-002] Unable to install new flows on compute nodes when having broken security group rules (CVE-2019-10876)

Wed, 10 Apr 2019 14:53:51 GMT

2019/04/10 -- Gage Hugo

[openstack-announce] [OSSA-2019-001] Unsupported dport option prevents applying security groups in OpenStack Neutron (CVE-2019-9735)

Mon, 18 Mar 2019 16:17:44 GMT

2019/03/18 -- Jeremy Stanley

[openstack-announce] OpenStack Rocky is officially released!

Thu, 30 Aug 2018 15:18:38 GMT

2018/08/30 -- Sean McGinnis

[openstack-announce] [all][elections] Project Team Lead Election Conclusion and Results

Thu, 30 Aug 2018 15:15:02 GMT

2018/08/30 -- Tony Breeds

[openstack-announce] [OSSA-2018-002] GET /v3/OS-FEDERATION/projects leaks project information (CVE-2018-14432)

Wed, 25 Jul 2018 18:14:39 GMT

2018/07/25 -- Matthew Thode

[openstack-announce] [OSSA-2018-001] Raw underlying encrypted volume access (CVE-2017-18191)

Fri, 20 Apr 2018 14:54:02 GMT

2018/04/20 -- Tristan Cacqueray

[openstack-announce] OpenStack Queens is officially released!

Wed, 28 Feb 2018 14:47:59 GMT

2018/02/28 -- Sean McGinnis

[openstack-announce] [OSSA 2017-005.1] Nova Filter Scheduler bypass through rebuild action (CVE-2017-16239) ERRATA

Tue, 05 Dec 2017 14:58:56 GMT

2017/12/05 -- Tristan Cacqueray

[openstack-announce] [OSSA-2017-005] Nova Filter Scheduler bypass through rebuild action (CVE-2017-16239)

Tue, 14 Nov 2017 16:33:56 GMT

2017/11/14 -- Tristan Cacqueray

[openstack-announce] OpenStack Pike is officially released!

Wed, 30 Aug 2017 13:28:30 GMT

2017/08/30 -- Thierry Carrez

[openstack-announce] [OSSA-2017-004] federated user gets wrong role (CVE-2017-2673)

Tue, 25 Apr 2017 15:46:03 GMT

2017/04/25 -- Tristan Cacqueray

[openstack-announce] [all][elections] Technical Committee Election Results

Fri, 21 Apr 2017 00:40:27 GMT

2017/04/21 -- Tristan Cacqueray

[openstack-announce] [OSSA-2017-003] XSS in Horizon federation mappings UI (CVE-2017-7400)

Thu, 06 Apr 2017 01:54:36 GMT

2017/04/06 -- Tristan Cacqueray