Current Series Release Notes

18.0.0.0rc1-6

Security Issues

• Fixed two security flaws with the v2 API: any user could update/delete a lease from any project via the v2 API, provided that they had the lease ID. Additionally, any user could use the v2 API to list all leases, including those in another project. LP#2162719

  Operators that cannot yet upgrade should consider instead disabling the v2 API with the following config in blazar.conf:

  [api]
  api_v2_controllers =
  

Bug Fixes

• The blazar-api command exited as soon as it started, with status 0, since eventlet was replaced with threading in the API: it started its HTTP server in a daemon thread and returned. It now serves in the foreground again, handling each request in a thread of its own as the eventlet server handled them concurrently. Deployments that run the API under a WSGI server, through blazar.wsgi.api:application, were not affected.

• The resource property list API with detail=true now returns the actual private flag of each property. Previously it always returned false, even for private properties listed by an admin with all=true.