Qemu version pin vulnerable to VENOM

[Christopher H. Laco]

With the public disclosure of CVE-2015-3456, the version of qemu will need to be bumped in Juno/Icehouse once the updated package is released upstream. The currently pinned version is qemu: 2.0.0+dfsg-2ubuntu1.2

Further information can be found:

http://venom.crowdstrike.com/
http://seclists.org/oss-sec/2015/q2/421
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3456
https://rhn.redhat.com/errata/RHSA-2015-0998.html
http://www.darkreading.com/cloud/venom-zero-day-may-affect-thousands-of-cloud-virtualization-products/d/d-id/1320389
http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-3456.html
http://lists.openstack.org/pipermail/openstack-operators/2015-May/006945.html

https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/VENOM

[Kevin Carter (kevin-carter)]

While the issue of the qemu package effects all of Ubuntu 14.04 the issue due to package pinning does not effect trunk and kilo as such trunk has been marked as invalid.

[George Shuklin (george-shuklin)]

Can someone explain how it can affect openstack installation? I don't see any 'virtual floppy' device inside guest machines.

[Ian Cordasco (icordasc)]

George, please see the discussion on the openstack-operators mailing list: http://lists.openstack.org/pipermail/openstack-operators/2015-May/006945.html

[Jimmy McCrory (jimmy-mccrory)]

Does this only apply to the script creating a frozen RPC repo?
https://raw.githubusercontent.com/stackforge/os-ansible-deployment/juno/scripts/elsa_repo_config.yml

[Christopher H. Laco (claco)]

Jimmy, I filed this as it happened so people would at least dig in further. I very well may be the case now that this barely effects anything, except as you've noticed, the repo config file you have linked to.