-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================                   Red Hat Security Advisory

Synopsis:          Moderate: Red Hat Ceph Storage 3.3 security and bug fix update
Advisory ID:       RHSA-2020:3504-01
Product:           Red Hat Ceph Storage
Advisory URL:      https://access.redhat.com/errata/RHSA-2020:3504
Issue date:        2020-08-18
CVE Names:         CVE-2020-10753 
====================================================================
1. Summary:

Updated packages that fixes one security issue and multiple bugs are now
available for Red Hat Ceph Storage 3.3.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Ceph Storage 3.3 MON - ppc64le, x86_64
Red Hat Ceph Storage 3.3 OSD - ppc64le, x86_64
Red Hat Ceph Storage 3.3 Tools - noarch, ppc64le, x86_64

3. Description:

Red Hat Ceph Storage is a scalable, open, software-defined storage platform
that combines the most stable version of the Ceph storage system with a
Ceph management platform, deployment utilities, and support services.

Security Fix(es):

* ceph: radosgw: HTTP header injection via CORS ExposeHeader tag
(CVE-2020-10753)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Bug Fix(es):

* Previously, BlueFS failed to replay log which was corrupted due to a
previous written replay log. The BlueFS log corruption was caused by the
BlueFS log growing exponentially because of OSD functioning in a way where
sync_metadata was not invoked in some situations and if sync_metadata was
invoked the BlueFS log was not getting compacted even though there is no
new log data to flush. This log corruption caused Bluestore not to be
mounted and data loss in multiple OSDs. With this update, sync_metadata is
now invoked, BlueFS log is getting compacted even though  there is no new
log data to flush in sync_metadata, and avoid log corruption if log is
expanded. This prevents OSDs getting full due to BlueFS log growing
exponentially and also BlueFS getting corrupted. As a result, logs replay
and there is no data loss. (BZ#1849478)

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1821133 - [Tool] Update the ceph-bluestore-tool for adding rescue procedure for bluefs log replay
1831740 - Running rgw-orphan-list command never completes, currently running for 1 week
1840744 - CVE-2020-10753 ceph: radosgw: HTTP header injection via CORS ExposeHeader tag
1846830 - openstack overcloud ceph-upgrade run fails with error ""stat: cannot stat '/var/run/ceph/ceph-mon.controller-3.localdomain.asok': No such file or directory"
1847644 - new nfs-ganesha-selinux subpackage not shipped with RHCS 3.3 z5
1848134 - [Upgrades] OSP10 -> OSP13 ceph-ansible doesn't perform rolling_update after switch-to-containers because the cluster is left with NOUP flag set
1849478 - [RADOS] Backport changes related to bluefs log not being compacted and possibly getting corrupted after growing to extreme size
1850377 - `ceph-osd-run.sh` shall error gracefully when OSD_DEVICE can't be determined
1853057 - Bug allows ordered bucket listing to get stuck -- 3.3
1853457 - [OSP16.1][FFU] rgw does not come back up after docker_to_podman
1855384 - rgw: incorporate fixes in rgw-orphan-list script from upstream 3.3
1855881 - MDS assertion in locking completion
1856100 - [RGW] Lifecycle polices stopped processing after upgrade
1858733 - [RGW] Slow lc processing resulting in high object count
1862046 - FFU fails running docker2podman playbook when bluestore/lvm is used
1866252 - FFU 13->16.1 ceph osds are down and fail starting looking for /run/lvm/lvmetad.socket

6. Package List:

Red Hat Ceph Storage 3.3 MON:

Source:
ceph-12.2.12-124.el7cp.src.rpm

ppc64le:
ceph-base-12.2.12-124.el7cp.ppc64le.rpm
ceph-common-12.2.12-124.el7cp.ppc64le.rpm
ceph-debuginfo-12.2.12-124.el7cp.ppc64le.rpm
ceph-mgr-12.2.12-124.el7cp.ppc64le.rpm
ceph-mon-12.2.12-124.el7cp.ppc64le.rpm
ceph-selinux-12.2.12-124.el7cp.ppc64le.rpm
libcephfs-devel-12.2.12-124.el7cp.ppc64le.rpm
libcephfs2-12.2.12-124.el7cp.ppc64le.rpm
librados-devel-12.2.12-124.el7cp.ppc64le.rpm
librados2-12.2.12-124.el7cp.ppc64le.rpm
libradosstriper1-12.2.12-124.el7cp.ppc64le.rpm
librbd-devel-12.2.12-124.el7cp.ppc64le.rpm
librbd1-12.2.12-124.el7cp.ppc64le.rpm
librgw-devel-12.2.12-124.el7cp.ppc64le.rpm
librgw2-12.2.12-124.el7cp.ppc64le.rpm
python-cephfs-12.2.12-124.el7cp.ppc64le.rpm
python-rados-12.2.12-124.el7cp.ppc64le.rpm
python-rbd-12.2.12-124.el7cp.ppc64le.rpm
python-rgw-12.2.12-124.el7cp.ppc64le.rpm

x86_64:
ceph-base-12.2.12-124.el7cp.x86_64.rpm
ceph-common-12.2.12-124.el7cp.x86_64.rpm
ceph-debuginfo-12.2.12-124.el7cp.x86_64.rpm
ceph-mgr-12.2.12-124.el7cp.x86_64.rpm
ceph-mon-12.2.12-124.el7cp.x86_64.rpm
ceph-selinux-12.2.12-124.el7cp.x86_64.rpm
ceph-test-12.2.12-124.el7cp.x86_64.rpm
libcephfs-devel-12.2.12-124.el7cp.x86_64.rpm
libcephfs2-12.2.12-124.el7cp.x86_64.rpm
librados-devel-12.2.12-124.el7cp.x86_64.rpm
librados2-12.2.12-124.el7cp.x86_64.rpm
libradosstriper1-12.2.12-124.el7cp.x86_64.rpm
librbd-devel-12.2.12-124.el7cp.x86_64.rpm
librbd1-12.2.12-124.el7cp.x86_64.rpm
librgw-devel-12.2.12-124.el7cp.x86_64.rpm
librgw2-12.2.12-124.el7cp.x86_64.rpm
python-cephfs-12.2.12-124.el7cp.x86_64.rpm
python-rados-12.2.12-124.el7cp.x86_64.rpm
python-rbd-12.2.12-124.el7cp.x86_64.rpm
python-rgw-12.2.12-124.el7cp.x86_64.rpm

Red Hat Ceph Storage 3.3 OSD:

Source:
ceph-12.2.12-124.el7cp.src.rpm

ppc64le:
ceph-base-12.2.12-124.el7cp.ppc64le.rpm
ceph-common-12.2.12-124.el7cp.ppc64le.rpm
ceph-debuginfo-12.2.12-124.el7cp.ppc64le.rpm
ceph-osd-12.2.12-124.el7cp.ppc64le.rpm
ceph-selinux-12.2.12-124.el7cp.ppc64le.rpm
libcephfs-devel-12.2.12-124.el7cp.ppc64le.rpm
libcephfs2-12.2.12-124.el7cp.ppc64le.rpm
librados-devel-12.2.12-124.el7cp.ppc64le.rpm
librados2-12.2.12-124.el7cp.ppc64le.rpm
libradosstriper1-12.2.12-124.el7cp.ppc64le.rpm
librbd-devel-12.2.12-124.el7cp.ppc64le.rpm
librbd1-12.2.12-124.el7cp.ppc64le.rpm
librgw-devel-12.2.12-124.el7cp.ppc64le.rpm
librgw2-12.2.12-124.el7cp.ppc64le.rpm
python-cephfs-12.2.12-124.el7cp.ppc64le.rpm
python-rados-12.2.12-124.el7cp.ppc64le.rpm
python-rbd-12.2.12-124.el7cp.ppc64le.rpm
python-rgw-12.2.12-124.el7cp.ppc64le.rpm

x86_64:
ceph-base-12.2.12-124.el7cp.x86_64.rpm
ceph-common-12.2.12-124.el7cp.x86_64.rpm
ceph-debuginfo-12.2.12-124.el7cp.x86_64.rpm
ceph-osd-12.2.12-124.el7cp.x86_64.rpm
ceph-selinux-12.2.12-124.el7cp.x86_64.rpm
ceph-test-12.2.12-124.el7cp.x86_64.rpm
libcephfs-devel-12.2.12-124.el7cp.x86_64.rpm
libcephfs2-12.2.12-124.el7cp.x86_64.rpm
librados-devel-12.2.12-124.el7cp.x86_64.rpm
librados2-12.2.12-124.el7cp.x86_64.rpm
libradosstriper1-12.2.12-124.el7cp.x86_64.rpm
librbd-devel-12.2.12-124.el7cp.x86_64.rpm
librbd1-12.2.12-124.el7cp.x86_64.rpm
librgw-devel-12.2.12-124.el7cp.x86_64.rpm
librgw2-12.2.12-124.el7cp.x86_64.rpm
python-cephfs-12.2.12-124.el7cp.x86_64.rpm
python-rados-12.2.12-124.el7cp.x86_64.rpm
python-rbd-12.2.12-124.el7cp.x86_64.rpm
python-rgw-12.2.12-124.el7cp.x86_64.rpm

Red Hat Ceph Storage 3.3 Tools:

Source:
ceph-12.2.12-124.el7cp.src.rpm
ceph-ansible-3.2.48-1.el7cp.src.rpm
nfs-ganesha-2.7.4-13.el7cp.src.rpm

noarch:
ceph-ansible-3.2.48-1.el7cp.noarch.rpm
nfs-ganesha-selinux-2.7.4-13.el7cp.noarch.rpm

ppc64le:
ceph-base-12.2.12-124.el7cp.ppc64le.rpm
ceph-common-12.2.12-124.el7cp.ppc64le.rpm
ceph-debuginfo-12.2.12-124.el7cp.ppc64le.rpm
ceph-fuse-12.2.12-124.el7cp.ppc64le.rpm
ceph-mds-12.2.12-124.el7cp.ppc64le.rpm
ceph-radosgw-12.2.12-124.el7cp.ppc64le.rpm
ceph-selinux-12.2.12-124.el7cp.ppc64le.rpm
libcephfs-devel-12.2.12-124.el7cp.ppc64le.rpm
libcephfs2-12.2.12-124.el7cp.ppc64le.rpm
librados-devel-12.2.12-124.el7cp.ppc64le.rpm
librados2-12.2.12-124.el7cp.ppc64le.rpm
libradosstriper1-12.2.12-124.el7cp.ppc64le.rpm
librbd-devel-12.2.12-124.el7cp.ppc64le.rpm
librbd1-12.2.12-124.el7cp.ppc64le.rpm
librgw-devel-12.2.12-124.el7cp.ppc64le.rpm
librgw2-12.2.12-124.el7cp.ppc64le.rpm
nfs-ganesha-2.7.4-13.el7cp.ppc64le.rpm
nfs-ganesha-ceph-2.7.4-13.el7cp.ppc64le.rpm
nfs-ganesha-debuginfo-2.7.4-13.el7cp.ppc64le.rpm
nfs-ganesha-rgw-2.7.4-13.el7cp.ppc64le.rpm
python-cephfs-12.2.12-124.el7cp.ppc64le.rpm
python-rados-12.2.12-124.el7cp.ppc64le.rpm
python-rbd-12.2.12-124.el7cp.ppc64le.rpm
python-rgw-12.2.12-124.el7cp.ppc64le.rpm
rbd-mirror-12.2.12-124.el7cp.ppc64le.rpm

x86_64:
ceph-base-12.2.12-124.el7cp.x86_64.rpm
ceph-common-12.2.12-124.el7cp.x86_64.rpm
ceph-debuginfo-12.2.12-124.el7cp.x86_64.rpm
ceph-fuse-12.2.12-124.el7cp.x86_64.rpm
ceph-mds-12.2.12-124.el7cp.x86_64.rpm
ceph-radosgw-12.2.12-124.el7cp.x86_64.rpm
ceph-selinux-12.2.12-124.el7cp.x86_64.rpm
libcephfs-devel-12.2.12-124.el7cp.x86_64.rpm
libcephfs2-12.2.12-124.el7cp.x86_64.rpm
librados-devel-12.2.12-124.el7cp.x86_64.rpm
librados2-12.2.12-124.el7cp.x86_64.rpm
libradosstriper1-12.2.12-124.el7cp.x86_64.rpm
librbd-devel-12.2.12-124.el7cp.x86_64.rpm
librbd1-12.2.12-124.el7cp.x86_64.rpm
librgw-devel-12.2.12-124.el7cp.x86_64.rpm
librgw2-12.2.12-124.el7cp.x86_64.rpm
nfs-ganesha-2.7.4-13.el7cp.x86_64.rpm
nfs-ganesha-ceph-2.7.4-13.el7cp.x86_64.rpm
nfs-ganesha-debuginfo-2.7.4-13.el7cp.x86_64.rpm
nfs-ganesha-rgw-2.7.4-13.el7cp.x86_64.rpm
python-cephfs-12.2.12-124.el7cp.x86_64.rpm
python-rados-12.2.12-124.el7cp.x86_64.rpm
python-rbd-12.2.12-124.el7cp.x86_64.rpm
python-rgw-12.2.12-124.el7cp.x86_64.rpm
rbd-mirror-12.2.12-124.el7cp.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2020-10753
https://access.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2020 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBXzwY1tzjgjWX9erEAQhKYw//YXaz9oS3LLDJI3TxVrNyeETzkjYB1PpZ
zpHlIIZQ2X3wPv4h+jWV8mcXgDS0VtYr77JP8F0dwGIIrKhzvuZBecI+g6gTzOIp
5LXMsMdkgDGc1mMnGA1Tz2wYG8dXhukIWd8Fe1tIOxS0T8TcZodkCeJn1o0Wkear
XlFycVnL8foTZ6bOGa6gFs9IBQ6l52a/rj2vcAKXxK4yaYnpwXLZrJ5FRoa4sgcA
hc5Lo/Z44/xvctv08MSH0o17P898mPssqK6S1Q0R4ExtC7W+Rpeawxnd/d28yhcj
NVYp2dZoyrp5rcqbD2gT+jkwdJiZU3dyM314SYRRfVySEHEnn7nwXi0PmEshotbb
cuabhEoesNqdB3uo8hY9/fDrIsHd5LsM6IDfX2OO+aI9qFzF3lZJqVELhkhFG+XN
Aw9Gk2BBQgznxWOWxnVgJj7+FdtiVSgWyXeW9ryY1awsgSRu6LlmZQUOP919T8Py
TNbs4pq7q6vOKdQai+8ByXEOh1cRCrjnqmX32lAUytw23Fp68Sjs+3CbDvV0Xq7p
2VNqou7Isfyc1VMwyc0E0/HJ860sERxpv7/X0CehjLyhAHth36nC2cqRwI3Gu0hl
2SNuIoF/1NWUQ8IglpLm3BxhQ3aW4zEZS9TI7He+62+qQIAEfMmaz6FtumLH7EBT
i0PUdTqFFhU=VrVl
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce