)]}'
{"security-notes/OSSN-0063":[{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"704e5bf6c1e109fd00c32c6462d9b5a3a42a8547","unresolved":false,"context_lines":[{"line_number":1,"context_line":"Nova and Cinder Key Manager for Barbican Misuses Cached Credentials"},{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"9a68dd71_1b1e9963","line":1,"range":{"start_line":1,"start_character":1,"end_line":1,"end_character":67},"updated":"2016-01-21 17:27:41.000000000","message":"(nit) We don\u0027t usually capitalize everything in the title (only proper nouns).","commit_id":"f68ae54d16c0bf35302d7bbf5d976eb0d90264dc"},{"author":{"_account_id":11561,"name":"Dave McCowan","email":"dmccowan@cisco.com","username":"dave-mccowan"},"change_message_id":"215f57ebd6d33c9ce42226b87c5f456e1deee906","unresolved":false,"context_lines":[{"line_number":1,"context_line":"Nova and Cinder Key Manager for Barbican Misuses Cached Credentials"},{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"ba0121b8_eb1ea76e","line":1,"range":{"start_line":1,"start_character":1,"end_line":1,"end_character":67},"in_reply_to":"9a68dd71_1b1e9963","updated":"2016-03-31 14:12:16.000000000","message":"Done","commit_id":"f68ae54d16c0bf35302d7bbf5d976eb0d90264dc"},{"author":{"_account_id":10705,"name":"Darren Chan","email":"dazzachan@yahoo.com.au","username":"daz"},"change_message_id":"8faa139aac12d390f76e48a48725b30530fa40cc","unresolved":false,"context_lines":[{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"During the Icehouse and Juno releases the Cinder and Nova projects added a"},{"line_number":6,"context_line":"feature that supports storage volume encryption using keys stored in"},{"line_number":7,"context_line":"Barbican.  The Barbican key manger, that is part of Nova and"},{"line_number":8,"context_line":"Cinder, had a bug that can cause an authorized user to lose access to an"},{"line_number":9,"context_line":"encryption key or allow the wrong user to gain access to an encryption key."},{"line_number":10,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":2,"id":"7a5de9d1_6031470b","line":7,"range":{"start_line":7,"start_character":52,"end_line":7,"end_character":56},"updated":"2016-01-28 02:10:36.000000000","message":"Use lowercase for project names, see http://docs.openstack.org/contributor-guide/writing-style/openstack-components.html","commit_id":"f68ae54d16c0bf35302d7bbf5d976eb0d90264dc"},{"author":{"_account_id":11561,"name":"Dave McCowan","email":"dmccowan@cisco.com","username":"dave-mccowan"},"change_message_id":"215f57ebd6d33c9ce42226b87c5f456e1deee906","unresolved":false,"context_lines":[{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"During the Icehouse and Juno releases the Cinder and Nova projects added a"},{"line_number":6,"context_line":"feature that supports storage volume encryption using keys stored in"},{"line_number":7,"context_line":"Barbican.  The Barbican key manger, that is part of Nova and"},{"line_number":8,"context_line":"Cinder, had a bug that can cause an authorized user to lose access to an"},{"line_number":9,"context_line":"encryption key or allow the wrong user to gain access to an encryption key."},{"line_number":10,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":2,"id":"ba0121b8_4b107359","line":7,"range":{"start_line":7,"start_character":52,"end_line":7,"end_character":56},"in_reply_to":"7a5de9d1_6031470b","updated":"2016-03-31 14:12:16.000000000","message":"Done","commit_id":"f68ae54d16c0bf35302d7bbf5d976eb0d90264dc"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"704e5bf6c1e109fd00c32c6462d9b5a3a42a8547","unresolved":false,"context_lines":[{"line_number":14,"context_line":""},{"line_number":15,"context_line":"### Discussion ###"},{"line_number":16,"context_line":"The Barbican key manager is a feature that is part of Nova and Cinder to"},{"line_number":17,"context_line":"allow those project to store or retrieve keys in Barbican.  The key"},{"line_number":18,"context_line":"manager includes a cache function that allows for a copy_key() operation"},{"line_number":19,"context_line":"to work while only validating the token once with Keystone."},{"line_number":20,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":2,"id":"9a68dd71_dbe9e11b","line":17,"range":{"start_line":17,"start_character":12,"end_line":17,"end_character":19},"updated":"2016-01-21 17:27:41.000000000","message":"(nit) projects","commit_id":"f68ae54d16c0bf35302d7bbf5d976eb0d90264dc"},{"author":{"_account_id":11561,"name":"Dave McCowan","email":"dmccowan@cisco.com","username":"dave-mccowan"},"change_message_id":"215f57ebd6d33c9ce42226b87c5f456e1deee906","unresolved":false,"context_lines":[{"line_number":14,"context_line":""},{"line_number":15,"context_line":"### Discussion ###"},{"line_number":16,"context_line":"The Barbican key manager is a feature that is part of Nova and Cinder to"},{"line_number":17,"context_line":"allow those project to store or retrieve keys in Barbican.  The key"},{"line_number":18,"context_line":"manager includes a cache function that allows for a copy_key() operation"},{"line_number":19,"context_line":"to work while only validating the token once with Keystone."},{"line_number":20,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":2,"id":"ba0121b8_2b153f48","line":17,"range":{"start_line":17,"start_character":12,"end_line":17,"end_character":19},"in_reply_to":"9a68dd71_dbe9e11b","updated":"2016-03-31 14:12:16.000000000","message":"Done","commit_id":"f68ae54d16c0bf35302d7bbf5d976eb0d90264dc"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"704e5bf6c1e109fd00c32c6462d9b5a3a42a8547","unresolved":false,"context_lines":[{"line_number":19,"context_line":"to work while only validating the token once with Keystone."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"This cache function had a bug such that the cached token was used for"},{"line_number":22,"context_line":"operations where it was invalid.  The symptoms of this error vary, but"},{"line_number":23,"context_line":"include a user not being able to access his key or the wrong user being"},{"line_number":24,"context_line":"able to access a key."},{"line_number":25,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":2,"id":"9a68dd71_5b55f14d","line":22,"range":{"start_line":22,"start_character":11,"end_line":22,"end_character":31},"updated":"2016-01-21 17:27:41.000000000","message":"Do you mean \"when the token was no longer valid\"?","commit_id":"f68ae54d16c0bf35302d7bbf5d976eb0d90264dc"},{"author":{"_account_id":11561,"name":"Dave McCowan","email":"dmccowan@cisco.com","username":"dave-mccowan"},"change_message_id":"215f57ebd6d33c9ce42226b87c5f456e1deee906","unresolved":false,"context_lines":[{"line_number":19,"context_line":"to work while only validating the token once with Keystone."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"This cache function had a bug such that the cached token was used for"},{"line_number":22,"context_line":"operations where it was invalid.  The symptoms of this error vary, but"},{"line_number":23,"context_line":"include a user not being able to access his key or the wrong user being"},{"line_number":24,"context_line":"able to access a key."},{"line_number":25,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":2,"id":"ba0121b8_6b0bb72a","line":22,"range":{"start_line":22,"start_character":11,"end_line":22,"end_character":31},"in_reply_to":"9a68dd71_5b55f14d","updated":"2016-03-31 14:12:16.000000000","message":"Done","commit_id":"f68ae54d16c0bf35302d7bbf5d976eb0d90264dc"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"704e5bf6c1e109fd00c32c6462d9b5a3a42a8547","unresolved":false,"context_lines":[{"line_number":24,"context_line":"able to access a key."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"An affected user would see an error similar to this in their Cinder log."},{"line_number":27,"context_line":"---- begin cinder.log sample snippet ----"},{"line_number":28,"context_line":"2015-12-03 09:09:03.648 TRACE cinder.volume.api Unauthorized: The request you"},{"line_number":29,"context_line":"have made requires authentication. (Disable debug mode to suppress these"},{"line_number":30,"context_line":"details.) (HTTP 401) (Request-ID: req-d2c52e0b-c16d-43ec-a7a0-7611113f1270)"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"9a68dd71_5bc5f18b","line":27,"range":{"start_line":27,"start_character":0,"end_line":27,"end_character":41},"updated":"2016-01-21 17:27:41.000000000","message":"(nit) Add a blank line before the example header to make it easier to read.","commit_id":"f68ae54d16c0bf35302d7bbf5d976eb0d90264dc"},{"author":{"_account_id":11561,"name":"Dave McCowan","email":"dmccowan@cisco.com","username":"dave-mccowan"},"change_message_id":"215f57ebd6d33c9ce42226b87c5f456e1deee906","unresolved":false,"context_lines":[{"line_number":24,"context_line":"able to access a key."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"An affected user would see an error similar to this in their Cinder log."},{"line_number":27,"context_line":"---- begin cinder.log sample snippet ----"},{"line_number":28,"context_line":"2015-12-03 09:09:03.648 TRACE cinder.volume.api Unauthorized: The request you"},{"line_number":29,"context_line":"have made requires authentication. (Disable debug mode to suppress these"},{"line_number":30,"context_line":"details.) (HTTP 401) (Request-ID: req-d2c52e0b-c16d-43ec-a7a0-7611113f1270)"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"ba0121b8_cb048319","line":27,"range":{"start_line":27,"start_character":0,"end_line":27,"end_character":41},"in_reply_to":"9a68dd71_5bc5f18b","updated":"2016-03-31 14:12:16.000000000","message":"Done","commit_id":"f68ae54d16c0bf35302d7bbf5d976eb0d90264dc"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"704e5bf6c1e109fd00c32c6462d9b5a3a42a8547","unresolved":false,"context_lines":[{"line_number":37,"context_line":""},{"line_number":38,"context_line":"A specification for a fix has been merged and targeted for the Mitaka"},{"line_number":39,"context_line":"release of both Nova and Cinder.  Additionally these patches have been"},{"line_number":40,"context_line":"backported to Kilo and Liberty. \u003cBackports in progress\u003e"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"### Contacts / References ###"},{"line_number":43,"context_line":"This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0063"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"9a68dd71_3b511dd9","line":40,"range":{"start_line":40,"start_character":14,"end_line":40,"end_character":30},"updated":"2016-01-21 17:27:41.000000000","message":"Maybe mention \"stable release branches\", or \"for a future stable update\".","commit_id":"f68ae54d16c0bf35302d7bbf5d976eb0d90264dc"},{"author":{"_account_id":11561,"name":"Dave McCowan","email":"dmccowan@cisco.com","username":"dave-mccowan"},"change_message_id":"215f57ebd6d33c9ce42226b87c5f456e1deee906","unresolved":false,"context_lines":[{"line_number":37,"context_line":""},{"line_number":38,"context_line":"A specification for a fix has been merged and targeted for the Mitaka"},{"line_number":39,"context_line":"release of both Nova and Cinder.  Additionally these patches have been"},{"line_number":40,"context_line":"backported to Kilo and Liberty. \u003cBackports in progress\u003e"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"### Contacts / References ###"},{"line_number":43,"context_line":"This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0063"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"ba0121b8_ab014f08","line":40,"range":{"start_line":40,"start_character":14,"end_line":40,"end_character":30},"in_reply_to":"9a68dd71_3b511dd9","updated":"2016-03-31 14:12:16.000000000","message":"Done","commit_id":"f68ae54d16c0bf35302d7bbf5d976eb0d90264dc"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"704e5bf6c1e109fd00c32c6462d9b5a3a42a8547","unresolved":false,"context_lines":[{"line_number":41,"context_line":""},{"line_number":42,"context_line":"### Contacts / References ###"},{"line_number":43,"context_line":"This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0063"},{"line_number":44,"context_line":"Original LaunchPad Bug : https://bugs.launchpad.net/glance/+bug/1523646"},{"line_number":45,"context_line":"OpenStack Security ML : openstack-security@lists.openstack.org"},{"line_number":46,"context_line":"OpenStack Security Group : https://launchpad.net/~openstack-ossg"},{"line_number":47,"context_line":"Nova Spec for fix : https://review.openstack.org/#/c/254358/"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"9a68dd71_3b683d87","line":44,"range":{"start_line":44,"start_character":25,"end_line":44,"end_character":71},"updated":"2016-01-21 17:27:41.000000000","message":"This should be:\n\n  https://bugs.launchpad.net/cinder/+bug/1523646","commit_id":"f68ae54d16c0bf35302d7bbf5d976eb0d90264dc"},{"author":{"_account_id":11561,"name":"Dave McCowan","email":"dmccowan@cisco.com","username":"dave-mccowan"},"change_message_id":"215f57ebd6d33c9ce42226b87c5f456e1deee906","unresolved":false,"context_lines":[{"line_number":41,"context_line":""},{"line_number":42,"context_line":"### Contacts / References ###"},{"line_number":43,"context_line":"This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0063"},{"line_number":44,"context_line":"Original LaunchPad Bug : https://bugs.launchpad.net/glance/+bug/1523646"},{"line_number":45,"context_line":"OpenStack Security ML : openstack-security@lists.openstack.org"},{"line_number":46,"context_line":"OpenStack Security Group : https://launchpad.net/~openstack-ossg"},{"line_number":47,"context_line":"Nova Spec for fix : https://review.openstack.org/#/c/254358/"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"ba0121b8_fd002a03","line":44,"range":{"start_line":44,"start_character":25,"end_line":44,"end_character":71},"in_reply_to":"9a68dd71_3b683d87","updated":"2016-03-31 14:12:16.000000000","message":"Done","commit_id":"f68ae54d16c0bf35302d7bbf5d976eb0d90264dc"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"704e5bf6c1e109fd00c32c6462d9b5a3a42a8547","unresolved":false,"context_lines":[{"line_number":44,"context_line":"Original LaunchPad Bug : https://bugs.launchpad.net/glance/+bug/1523646"},{"line_number":45,"context_line":"OpenStack Security ML : openstack-security@lists.openstack.org"},{"line_number":46,"context_line":"OpenStack Security Group : https://launchpad.net/~openstack-ossg"},{"line_number":47,"context_line":"Nova Spec for fix : https://review.openstack.org/#/c/254358/"},{"line_number":48,"context_line":"Cinder Spec for fix : https://review.openstack.org/#/c/254357/"},{"line_number":49,"context_line":"CVE : N/A"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"9a68dd71_fbbdc5d7","line":47,"range":{"start_line":47,"start_character":5,"end_line":47,"end_character":9},"updated":"2016-01-21 17:27:41.000000000","message":"The term \"spec\" is overloaded.  I\u0027d just say \"review\", or even \"propsed patch\".","commit_id":"f68ae54d16c0bf35302d7bbf5d976eb0d90264dc"},{"author":{"_account_id":11561,"name":"Dave McCowan","email":"dmccowan@cisco.com","username":"dave-mccowan"},"change_message_id":"215f57ebd6d33c9ce42226b87c5f456e1deee906","unresolved":false,"context_lines":[{"line_number":44,"context_line":"Original LaunchPad Bug : https://bugs.launchpad.net/glance/+bug/1523646"},{"line_number":45,"context_line":"OpenStack Security ML : openstack-security@lists.openstack.org"},{"line_number":46,"context_line":"OpenStack Security Group : https://launchpad.net/~openstack-ossg"},{"line_number":47,"context_line":"Nova Spec for fix : https://review.openstack.org/#/c/254358/"},{"line_number":48,"context_line":"Cinder Spec for fix : https://review.openstack.org/#/c/254357/"},{"line_number":49,"context_line":"CVE : N/A"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"ba0121b8_3d074219","line":47,"range":{"start_line":47,"start_character":5,"end_line":47,"end_character":9},"in_reply_to":"9a68dd71_fbbdc5d7","updated":"2016-03-31 14:12:16.000000000","message":"Done","commit_id":"f68ae54d16c0bf35302d7bbf5d976eb0d90264dc"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"b1d00b28d73caf1ba393321ddc8d2cbe423342c0","unresolved":false,"context_lines":[{"line_number":1,"context_line":"Nova and cinder key manager for barbican misuses cached credentials"},{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"ba0121b8_f3897927","line":1,"range":{"start_line":1,"start_character":9,"end_line":1,"end_character":15},"updated":"2016-03-31 15:11:44.000000000","message":"There\u0027s a lot of switching case for services. Nova is uppercase, cinder is lower, but both are upper on 5, barbican is lower on 7 (twice), and then both are lower on 7/8 and so on. I\u0027d say uppercase service names for readability.","commit_id":"eeea4856e0c92e34a321d8dd7eb6aa68d29271b9"},{"author":{"_account_id":11561,"name":"Dave McCowan","email":"dmccowan@cisco.com","username":"dave-mccowan"},"change_message_id":"43c3bc808bf78cb85083f877ffc985ec3c364119","unresolved":false,"context_lines":[{"line_number":1,"context_line":"Nova and cinder key manager for barbican misuses cached credentials"},{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"ba0121b8_f30fb234","line":1,"range":{"start_line":1,"start_character":9,"end_line":1,"end_character":15},"in_reply_to":"ba0121b8_10e05c95","updated":"2016-03-31 16:48:42.000000000","message":"The standard is for project names to be lowercase, except at the beginning of a sentence.  Looks like a missed a couple, I\u0027ll make sure they are all lowercase, following the convention, in the next patch.","commit_id":"eeea4856e0c92e34a321d8dd7eb6aa68d29271b9"},{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"519aeff305bc0608d1fd7ee4d0ed7d8c259a211b","unresolved":false,"context_lines":[{"line_number":1,"context_line":"Nova and cinder key manager for barbican misuses cached credentials"},{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"ba0121b8_10e05c95","line":1,"range":{"start_line":1,"start_character":9,"end_line":1,"end_character":15},"in_reply_to":"ba0121b8_f3897927","updated":"2016-03-31 16:24:19.000000000","message":"i agree about consistency, not sure if we have established a protocol for service names in the OSSNs. but i agree, one way or the other and stay consistent.","commit_id":"eeea4856e0c92e34a321d8dd7eb6aa68d29271b9"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"b1d00b28d73caf1ba393321ddc8d2cbe423342c0","unresolved":false,"context_lines":[{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"During the Icehouse and Juno releases the Cinder and Nova projects added a"},{"line_number":6,"context_line":"feature that supports storage volume encryption using keys stored in"},{"line_number":7,"context_line":"barbican.  The barbican key manger, that is part of nova and"},{"line_number":8,"context_line":"cinder, had a bug that can cause an authorized user to lose access to an"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"ba0121b8_b34c21c9","line":5,"range":{"start_line":5,"start_character":24,"end_line":5,"end_character":28},"updated":"2016-03-31 15:11:44.000000000","message":"Two releases are mentioned here, but 4 below. I\u0027d recommend just mentioning Icehouse as that was the first, and then note that it was remediated in Mitaka.","commit_id":"eeea4856e0c92e34a321d8dd7eb6aa68d29271b9"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"b1d00b28d73caf1ba393321ddc8d2cbe423342c0","unresolved":false,"context_lines":[{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"During the Icehouse and Juno releases the Cinder and Nova projects added a"},{"line_number":6,"context_line":"feature that supports storage volume encryption using keys stored in"},{"line_number":7,"context_line":"barbican.  The barbican key manger, that is part of nova and"},{"line_number":8,"context_line":"cinder, had a bug that can cause an authorized user to lose access to an"},{"line_number":9,"context_line":"encryption key or allow the wrong user to gain access to an encryption key."},{"line_number":10,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":3,"id":"ba0121b8_b391c1f3","line":7,"range":{"start_line":7,"start_character":34,"end_line":7,"end_character":35},"updated":"2016-03-31 15:11:44.000000000","message":"I would remove this comma","commit_id":"eeea4856e0c92e34a321d8dd7eb6aa68d29271b9"},{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"ff221650e5e7799fa538394601e991b6d4be1f04","unresolved":false,"context_lines":[{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"During the Icehouse and Juno releases the Cinder and Nova projects added a"},{"line_number":6,"context_line":"feature that supports storage volume encryption using keys stored in"},{"line_number":7,"context_line":"barbican.  The barbican key manger, that is part of nova and"},{"line_number":8,"context_line":"cinder, had a bug that can cause an authorized user to lose access to an"},{"line_number":9,"context_line":"encryption key or allow the wrong user to gain access to an encryption key."},{"line_number":10,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":3,"id":"ba0121b8_10a85c76","line":7,"range":{"start_line":7,"start_character":28,"end_line":7,"end_character":34},"updated":"2016-03-31 16:22:50.000000000","message":"s/manger/manager/","commit_id":"eeea4856e0c92e34a321d8dd7eb6aa68d29271b9"},{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"ff221650e5e7799fa538394601e991b6d4be1f04","unresolved":false,"context_lines":[{"line_number":16,"context_line":"The barbican key manager is a feature that is part of nova and cinder to"},{"line_number":17,"context_line":"allow those projects to store or retrieve keys in barbican.  The key"},{"line_number":18,"context_line":"manager includes a cache function that allows for a copy_key() operation"},{"line_number":19,"context_line":"to work while only validating the token once with Keystone."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"This cache function had a bug such that the cached token was used for"},{"line_number":22,"context_line":"operations where it was no longer valid.  The symptoms of this error vary, but"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"ba0121b8_10bfbcaa","line":19,"range":{"start_line":19,"start_character":50,"end_line":19,"end_character":58},"updated":"2016-03-31 16:22:50.000000000","message":"s/Keystone/keystone/","commit_id":"eeea4856e0c92e34a321d8dd7eb6aa68d29271b9"},{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"ff221650e5e7799fa538394601e991b6d4be1f04","unresolved":false,"context_lines":[{"line_number":19,"context_line":"to work while only validating the token once with Keystone."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"This cache function had a bug such that the cached token was used for"},{"line_number":22,"context_line":"operations where it was no longer valid.  The symptoms of this error vary, but"},{"line_number":23,"context_line":"include a user not being able to access his key or the wrong user being"},{"line_number":24,"context_line":"able to access a key."},{"line_number":25,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":3,"id":"ba0121b8_b0e6d0e5","line":22,"range":{"start_line":22,"start_character":40,"end_line":22,"end_character":42},"updated":"2016-03-31 16:22:50.000000000","message":"double space","commit_id":"eeea4856e0c92e34a321d8dd7eb6aa68d29271b9"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"b1d00b28d73caf1ba393321ddc8d2cbe423342c0","unresolved":false,"context_lines":[{"line_number":50,"context_line":"Cinder patch for Mitaka : https://review.openstack.org/254357/"},{"line_number":51,"context_line":"Cinder patch for stable/liberty: https://review.openstack.org/266678"},{"line_number":52,"context_line":"Cinder patch for stable/kilo: https://review.openstack.org/266680"},{"line_number":53,"context_line":"CVE : N/A"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"ba0121b8_361e3f5f","line":53,"range":{"start_line":53,"start_character":8,"end_line":53,"end_character":9},"updated":"2016-03-31 15:11:44.000000000","message":"If there is no CVE do we need to note that? Or should we just remove the line?","commit_id":"eeea4856e0c92e34a321d8dd7eb6aa68d29271b9"},{"author":{"_account_id":9162,"name":"Lana Brindley","email":"openstack@lanabrindley.com","username":"loquacity"},"change_message_id":"944fcf315b384346b93eb0fec5f9ebcd2e423f11","unresolved":false,"context_lines":[{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"During the Icehouse release the Cinder and Nova projects added a"},{"line_number":6,"context_line":"feature that supports storage volume encryption using keys stored in"},{"line_number":7,"context_line":"Barbican. The Barbican key manger, that is part of Nova and"},{"line_number":8,"context_line":"Cinder, had a bug that can cause an authorized user to lose access to an"},{"line_number":9,"context_line":"encryption key or allow the wrong user to gain access to an encryption key."},{"line_number":10,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":4,"id":"bab6814e_c6d37b5e","line":7,"updated":"2016-05-24 02:03:18.000000000","message":"manager*","commit_id":"2c24596be98d747d238e948097eb73334a36876f"},{"author":{"_account_id":9162,"name":"Lana Brindley","email":"openstack@lanabrindley.com","username":"loquacity"},"change_message_id":"944fcf315b384346b93eb0fec5f9ebcd2e423f11","unresolved":false,"context_lines":[{"line_number":5,"context_line":"During the Icehouse release the Cinder and Nova projects added a"},{"line_number":6,"context_line":"feature that supports storage volume encryption using keys stored in"},{"line_number":7,"context_line":"Barbican. The Barbican key manger, that is part of Nova and"},{"line_number":8,"context_line":"Cinder, had a bug that can cause an authorized user to lose access to an"},{"line_number":9,"context_line":"encryption key or allow the wrong user to gain access to an encryption key."},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"### Affected Services / Software ###"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"bab6814e_26c9a7ad","line":8,"updated":"2016-05-24 02:03:18.000000000","message":"s/can/could (to keep the sentence in past tense. This is a thing that is no longer happening).","commit_id":"2c24596be98d747d238e948097eb73334a36876f"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"8f3ff76a6f11bfe0c9e2b9dde543bab6f9a716f6","unresolved":false,"context_lines":[{"line_number":32,"context_line":"---- end cinder.log sample snippet ----"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"### Recommended Actions ###"},{"line_number":35,"context_line":"Users wishing to use the Barbican key manager to provided keys for volume"},{"line_number":36,"context_line":"encryption with Nova and Cinder should ensure they are using a patched"},{"line_number":37,"context_line":"version."},{"line_number":38,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":6,"id":"9abb7d3a_60041cc6","line":35,"updated":"2016-06-02 18:08:08.000000000","message":"should this be *provide?","commit_id":"f7df1f4041041cea06afd0cf811ccee6cc29b76c"}]}