)]}'
{"ossa/OSSA-2018-001.yaml":[{"author":{"_account_id":5263,"name":"Jeremy Stanley","display_name":"fungi","email":"fungi@yuggoth.org","username":"fungi","status":"missing, presumed fed"},"change_message_id":"d318320aac231b9a6b709c3162a849ad7ce86ed8","unresolved":false,"context_lines":[{"line_number":9,"context_line":"  volumes handling. By detaching and reattaching an encrypted volume"},{"line_number":10,"context_line":"  an attacker may access the underlying raw volume and corrupt the"},{"line_number":11,"context_line":"  LUKS header resuling in a denial of service attack on the compute host."},{"line_number":12,"context_line":"  All Nova setup supporting encrypted volumes are affected."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"affected-products:"},{"line_number":15,"context_line":"  - product: nova"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"3fa0c359_0bad02e8","line":12,"updated":"2018-02-11 01:25:09.000000000","message":"setups (plural)","commit_id":"77daaa538bd68372287097a0247ff425a75e500f"},{"author":{"_account_id":9311,"name":"Tristan Cacqueray","email":"tdecacqu@redhat.com","username":"tristanC"},"change_message_id":"6e17060e5c5404e79a1a81cfbfbbf44d8060083c","unresolved":false,"context_lines":[{"line_number":9,"context_line":"  volumes handling. By detaching and reattaching an encrypted volume"},{"line_number":10,"context_line":"  an attacker may access the underlying raw volume and corrupt the"},{"line_number":11,"context_line":"  LUKS header resuling in a denial of service attack on the compute host."},{"line_number":12,"context_line":"  All Nova setup supporting encrypted volumes are affected."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"affected-products:"},{"line_number":15,"context_line":"  - product: nova"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"3fa0c359_dba17d97","line":12,"in_reply_to":"3fa0c359_0bad02e8","updated":"2018-02-19 01:42:02.000000000","message":"Done","commit_id":"77daaa538bd68372287097a0247ff425a75e500f"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"8f9d79a9641ad16d77f69bb46e5401c43abf4936","unresolved":false,"context_lines":[{"line_number":33,"context_line":"    - https://review.openstack.org/460243"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"  pike:"},{"line_number":36,"context_line":"    - TBD"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"  ocata:"},{"line_number":39,"context_line":"    - TBD"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"3fa0c359_ee2c2fad","line":36,"range":{"start_line":36,"start_character":6,"end_line":36,"end_character":9},"updated":"2018-02-13 15:24:01.000000000","message":"https://review.openstack.org/#/c/543569","commit_id":"77daaa538bd68372287097a0247ff425a75e500f"},{"author":{"_account_id":9311,"name":"Tristan Cacqueray","email":"tdecacqu@redhat.com","username":"tristanC"},"change_message_id":"6e17060e5c5404e79a1a81cfbfbbf44d8060083c","unresolved":false,"context_lines":[{"line_number":33,"context_line":"    - https://review.openstack.org/460243"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"  pike:"},{"line_number":36,"context_line":"    - TBD"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"  ocata:"},{"line_number":39,"context_line":"    - TBD"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"3fa0c359_fb9c795c","line":36,"range":{"start_line":36,"start_character":6,"end_line":36,"end_character":9},"in_reply_to":"3fa0c359_ee2c2fad","updated":"2018-02-19 01:42:02.000000000","message":"Done","commit_id":"77daaa538bd68372287097a0247ff425a75e500f"},{"author":{"_account_id":5263,"name":"Jeremy Stanley","display_name":"fungi","email":"fungi@yuggoth.org","username":"fungi","status":"missing, presumed fed"},"change_message_id":"27ac4175d5cd101eeabea2981f4e8c5b2a7d8c82","unresolved":false,"context_lines":[{"line_number":1,"context_line":"date: 2018-02-20"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"id: OSSA-2018-001"},{"line_number":4,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"9f6a8fd7_7afa68bd","line":1,"updated":"2018-04-20 13:22:33.000000000","message":"Should we update this to today\u0027s/tomorrow\u0027s date or something similarly current to when we expect to publish the advisory?","commit_id":"50768bea1b6af825ed5b52e2774f4e6135a535e3"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"e26dfc8c004585960f1ab8ae8d286ed4b997e7a7","unresolved":false,"context_lines":[{"line_number":39,"context_line":"    - https://review.openstack.org/561604"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"notes:"},{"line_number":42,"context_line":"  - Pike and Ocata patches disable encrypted volume swapping, this feature"},{"line_number":43,"context_line":"    is now only supported in Nova version \u003e\u003d 17.0.0."}],"source_content_type":"text/x-yaml","patch_set":5,"id":"9f6a8fd7_e23ece89","line":43,"range":{"start_line":42,"start_character":62,"end_line":43,"end_character":52},"updated":"2018-04-20 15:43:31.000000000","message":"There are caveats with this I think based on if you\u0027re using libvirt and the version of qemu, and if you\u0027re using luks vs cryptsetup encryptors. Lee would know best.","commit_id":"c5f504bf1d2769191467b6a9749a1bb440750991"},{"author":{"_account_id":9311,"name":"Tristan Cacqueray","email":"tdecacqu@redhat.com","username":"tristanC"},"change_message_id":"35f3d1d503b0e8d0b7beb2bcae2b4664fbf2af2e","unresolved":false,"context_lines":[{"line_number":39,"context_line":"    - https://review.openstack.org/561604"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"notes:"},{"line_number":42,"context_line":"  - Pike and Ocata patches disable encrypted volume swapping, this feature"},{"line_number":43,"context_line":"    is now only supported in Nova version \u003e\u003d 17.0.0."}],"source_content_type":"text/x-yaml","patch_set":5,"id":"9f6a8fd7_6c7cde82","line":43,"range":{"start_line":42,"start_character":62,"end_line":43,"end_character":52},"in_reply_to":"9f6a8fd7_c2e5ca0a","updated":"2018-04-23 02:30:00.000000000","message":"I\u0027m confused, the Queens release notes doesn\u0027t mention these requirements. Just to be clear, when using natively encrypted disk, then they can\u0027t be swapped?\n\nIn that case, the note should probably be edited to: \"this feature is deprecated in Nova version \u003e\u003d 17.0.0 and only works with QEMU \u003c 2.6.0 and Livirt \u003c 2.2.0\"","commit_id":"c5f504bf1d2769191467b6a9749a1bb440750991"},{"author":{"_account_id":10135,"name":"Lee Yarwood","display_name":"Lee Yarwood","email":"lyarwood@redhat.com","username":"lyarwood"},"change_message_id":"16ce3b3a921c2c75de1b9765f1f94c4154efec0e","unresolved":false,"context_lines":[{"line_number":39,"context_line":"    - https://review.openstack.org/561604"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"notes:"},{"line_number":42,"context_line":"  - Pike and Ocata patches disable encrypted volume swapping, this feature"},{"line_number":43,"context_line":"    is now only supported in Nova version \u003e\u003d 17.0.0."}],"source_content_type":"text/x-yaml","patch_set":5,"id":"9f6a8fd7_c2e5ca0a","line":43,"range":{"start_line":42,"start_character":62,"end_line":43,"end_character":52},"in_reply_to":"9f6a8fd7_e23ece89","updated":"2018-04-20 15:50:20.000000000","message":"Yeah, it\u0027s only supported on Nova \u003e\u003d 17.0.0 when using a `plain` encrypted volume type _or_ with a `luks` encrypted volume type with QEMU \u003c2.6.0 and Libvirt \u003c2.2.0. Essentially anything that doesn\u0027t use native QEMU LUKS decryption for the volume.","commit_id":"c5f504bf1d2769191467b6a9749a1bb440750991"}]}