March 2026 - Yaook - lists.alasca.cloud

Yaook is at OpenInfra PGT

by Stefan Hoffmann

Hi yaook devs, we are invited to take part at the OpenInfra Project Team Gathering. I planned a session so we can meet and discuss further steps. We will have a session at 23.04.2026 13-15UTC[1] If you have already topics we can talk about, add them to the etherpad[2] Meeting link will be [3] Best Regards Stefan [1] https://ptg.opendev.org/ptg.html [2] https://etherpad.opendev.org/p/apr2026-ptg-yaook [3] https://meetpad.opendev.org/apr2026-ptg-yaook -- Stefan Hoffmann DevOps-Engineer Cloud&Heat Cloud&Heat Technologies GmbH Königsbrücker Straße 96 (Halle 15) | 01099 Dresden +49 351 479 367 36 stefan.hoffmann(a)cloudandheat.com | www.cloudandheat.com Green, Open, Efficient. Ihr Cloud-Service- und Cloud-Technologie-Provider aus Dresden. [1] Commercial Register: District Court Dresden Register Number: HRB 30549 VAT ID No.: DE281093504 Managing Director: Nicolas Röhrs Authorized signatory: Dr. Marius Feldmann [1] Ihr Cloud-Service- und Cloud-Technologie-Provider aus Dresden. https://www.cloudandheat.com/

March 24, 2026

[CVE][OSSA-2026-004] Server-Side Request Forgery (SSRF) vulnerabilities in OpenStack Glance image import functionality

by Stefan Hoffmann

Hi yaook and OpenStack Users, today a new security advisory was published by OpenStack and yaook now has a fix for it. Server-Side Request Forgery (SSRF) vulnerabilities in OpenStack Glance image import functionality By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only glance image import functionality is affected. In particular, the ‚web-download‘ and ‚glance-download‘ import methods are subject to this vulnerability, as is the optional (not enabled by default) ‚ovf_process‘ image import plugin. The following images are vulnerable: glance images BEFORE 1.1.156 Yaook versions <= v1.4.0 and 1.5.0 If any of these images are used in your cluster, the cluster is vulnerable. A new stable release 1.4.1 will be published today. You can upgrade to that release simply by updating your operators. Release 1.5.1 will also have this fix. If you don’t want to wait for the release, you can use a version override at the glance-operator (adjust the OpenStack version to the version you have deployed): values: operator: extraEnv: - name: YAOOK_OP_VERSIONS_OVERRIDE value: | registry.yaook.cloud/yaook/glance-2025.1: registry.yaook.cloud/yaook/glance-2025.1:1.1.156 See also https://yaook.cloud/security-advisories-ossa-2026-004/ Best regards Stefan -- Stefan Hoffmann DevOps-Engineer Cloud&Heat Cloud&Heat Technologies GmbH Königsbrücker Straße 96 (Halle 15) | 01099 Dresden +49 351 479 367 36 stefan.hoffmann(a)cloudandheat.com | www.cloudandheat.com Green, Open, Efficient. Ihr Cloud-Service- und Cloud-Technologie-Provider aus Dresden. [1] Commercial Register: District Court Dresden Register Number: HRB 30549 VAT ID No.: DE281093504 Managing Director: Nicolas Röhrs Authorized signatory: Dr. Marius Feldmann [1] Ihr Cloud-Service- und Cloud-Technologie-Provider aus Dresden. https://www.cloudandheat.com/

March 19, 2026

Help needed: 3-Minute Survey for FOSS Backstage Talk

by Daniel Gerber

Dear ALASCA members, developers, supporters and friends, In a few days I will be giving a talk at this years FOSS Backstage in Berlin. To ensure that I represent the perspectives and priorities of our community accurately, as well as help guiding ALASCA’s work going forward, I would appreciate it if you could take a moment to answer this short survey: https://nextcloud.cloudandheat.com/apps/forms/s/qMYM4FiNfjkzfCzybSGcoFYM It should not take you more then 3 minutes, the answer are anonymous and can be given till Friday the 13th of March, 23:59. Please excuse duplicate notification of this survey and please share it within our community. Cheers, Daniel P.S: In case you need an English version please contact me directly! —— Dr. Daniel Gerber Softwaredeveloper ALASCA - Verband für betriebsfähige, offene Cloud-Infrastrukturen e.V. c/o Cloud&Heat Technologies GmbH Königsbrücker Straße 96 | 01099 Dresden +49 351 479 367 00 daniel.gerber(a)alasca.cloud | https://alasca.cloud/ Let's learn. Let's discuss. Let's inspire. Let's tech-talk. Alle News zu den ALASCA-Tech-Talks gibt es hier: https://alasca.cloud/alasca-tech-talks/ Verantwortliche i.S.d. § 55 Abs. 2 RStV: Dr. Marius Feldmann (Vorsitzender | Cloud&Heat Technologies GmbH) Josephine Seifert (Stellvertretende Vorsitzende) Steffen Brauß (Schatzmeister | Schwarz IT KG) Registergericht: Amtsgericht Dresden Registernummer: VR 12961 Steuernummer: 202/140/21049

March 5, 2026

Yaook at OpenInfra PTG

by Stefan Hoffmann

Hi everyone, for the first time, yaook is part of the OpenInfra ProjectTeamGathering in April.[1] Currently the time of our session is not fixed, but the PTG will take plase at 20-24 April 2026, I will create a 2-4h session for us. Feel free to already register[2] so we know whom to expect and OpenInfra sees, the session is used. Soon we will share a etherpad where topics can be added. If you have wishes for a specific timeframe/day contact me. Best Regards Stefan [1] lists.openstack.org/archives/list/openstack-discuss@lists.openstack.org /thread/NDYECQOHPBHRNSBSSQCHAIB7LDPDC5XO/ [2] https://ptg.openinfra.org/

March 4, 2026