Security update for ceph

Announcement ID:	SUSE-SU-2018:1417-1
Rating:	important
References:	bsc#1051598 bsc#1054061 bsc#1056125 bsc#1056967 bsc#1059458 bsc#1060904 bsc#1061461 bsc#1063014 bsc#1066182 bsc#1066502 bsc#1067088 bsc#1067119 bsc#1067705 bsc#1070357 bsc#1071386 bsc#1074301 bsc#1079076 bsc#1080788 bsc#1081379 bsc#1081600 bsc#1086340 bsc#1087269 bsc#1087493
Cross-References:	CVE-2017-16818 CVE-2018-7262
CVSS scores:	CVE-2017-16818 ( SUSE ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2017-16818 ( NVD ): 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2018-7262 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products:	SUSE Container as a Service Platform 1.0 SUSE Container as a Service Platform 2.0 SUSE Linux Enterprise Desktop 12 SP3 SUSE Linux Enterprise High Performance Computing 12 SP3 SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Server for SAP Applications 12 SP3 SUSE Linux Enterprise Software Development Kit 12 SP3

An update that solves two vulnerabilities and has 21 security fixes can now be installed.

Description:

This update for ceph fixes the following issues:

Security issues fixed:

• CVE-2018-7262: rgw: malformed http headers can crash rgw (bsc#1081379).
• CVE-2017-16818: User reachable asserts allow for DoS (bsc#1063014).

Bug fixes:

• bsc#1061461: OSDs keep generating coredumps after adding new OSD node to cluster.
• bsc#1079076: RGW openssl fixes.
• bsc#1067088: Upgrade to SES5 restarted all nodes, majority of OSDs aborts during start.
• bsc#1056125: Some OSDs are down when doing performance testing on rbd image in EC Pool.
• bsc#1087269: allow_ec_overwrites option not in command options list.
• bsc#1051598: Fix mountpoint check for systemctl enable --runtime.
• bsc#1070357: Zabbix mgr module doesn't recover from HEALTH_ERR.
• bsc#1066502: After upgrading a single OSD from SES 4 to SES 5 the OSDs do not rejoin the cluster.
• bsc#1067119: Crushtool decompile creates wrong device entries (device 20 device20) for not existing / deleted OSDs.
• bsc#1060904: Loglevel misleading during keystone authentication.
• bsc#1056967: Monitors goes down after pool creation on cluster with 120 OSDs.
• bsc#1067705: Issues with RGW Multi-Site Federation between SES5 and RH Ceph Storage 2.
• bsc#1059458: Stopping / restarting rados gateway as part of deepsea stage.4 executions causes core-dump of radosgw.
• bsc#1087493: Commvault cannot reconnect to storage after restarting haproxy.
• bsc#1066182: Container synchronization between two Ceph clusters failed.
• bsc#1081600: Crash in civetweb/RGW.
• bsc#1054061: NFS-GANESHA service failing while trying to list mountpoint on client.
• bsc#1074301: OSDs keep aborting: SnapMapper failed asserts.
• bsc#1086340: XFS metadata corruption on rbd-nbd mapped image with journaling feature enabled.
• bsc#1080788: fsid mismatch when creating additional OSDs.
• bsc#1071386: Metadata spill onto block.slow.

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• SUSE Linux Enterprise Desktop 12 SP3
  zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2018-980=1
• SUSE Linux Enterprise Software Development Kit 12 SP3
  zypper in -t patch SUSE-SLE-SDK-12-SP3-2018-980=1
• SUSE Linux Enterprise Server 12 SP3
  zypper in -t patch SUSE-SLE-SERVER-12-SP3-2018-980=1
• SUSE Linux Enterprise Server for SAP Applications 12 SP3
  zypper in -t patch SUSE-SLE-SERVER-12-SP3-2018-980=1
• SUSE Linux Enterprise High Performance Computing 12 SP3
  zypper in -t patch SUSE-SLE-SERVER-12-SP3-2018-980=1
• SUSE Container as a Service Platform 2.0
  To install this update, use the SUSE CaaS Platform 'skuba' tool. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way.
• SUSE Container as a Service Platform 1.0
  To install this update, use the SUSE CaaS Platform 'skuba' tool. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way.

Package List:

• SUSE Linux Enterprise Desktop 12 SP3 (x86_64)
  • librados2-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • python-rbd-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • libradosstriper1-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • librbd1-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • python-rgw-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • python-rgw-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • python-rados-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • ceph-common-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • ceph-common-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • librgw2-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • python-cephfs-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • python-cephfs-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • ceph-debugsource-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • libcephfs2-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • python-rados-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • python-rbd-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • libcephfs2-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • librados2-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • librgw2-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • librbd1-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • libradosstriper1-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
• SUSE Linux Enterprise Software Development Kit 12 SP3 (aarch64 ppc64le s390x x86_64)
  • librados-devel-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • libcephfs-devel-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • ceph-debugsource-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • librbd-devel-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • librados-devel-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
• SUSE Linux Enterprise Server 12 SP3 (aarch64 ppc64le s390x x86_64)
  • librados2-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • python-rbd-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • libradosstriper1-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • librbd1-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • python-rgw-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • python-rgw-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • python-rados-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • ceph-common-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • librgw2-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • ceph-common-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • python-cephfs-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • python-cephfs-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • ceph-debugsource-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • libcephfs2-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • python-rados-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • python-rbd-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • libcephfs2-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • librados2-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • librgw2-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • librbd1-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • libradosstriper1-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
• SUSE Linux Enterprise Server for SAP Applications 12 SP3 (ppc64le x86_64)
  • librados2-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • python-rbd-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • libradosstriper1-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • librbd1-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • python-rgw-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • python-rgw-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • python-rados-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • ceph-common-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • librgw2-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • ceph-common-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • python-cephfs-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • python-cephfs-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • ceph-debugsource-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • libcephfs2-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • python-rados-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • python-rbd-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • libcephfs2-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • librados2-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • librgw2-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • librbd1-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • libradosstriper1-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
• SUSE Linux Enterprise High Performance Computing 12 SP3 (aarch64 x86_64)
  • librados2-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • python-rbd-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • libradosstriper1-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • librbd1-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • python-rgw-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • python-rgw-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • python-rados-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • ceph-common-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • librgw2-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • ceph-common-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • python-cephfs-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • python-cephfs-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • ceph-debugsource-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • libcephfs2-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • python-rados-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • python-rbd-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • libcephfs2-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • librados2-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • librgw2-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • librbd1-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • libradosstriper1-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
• SUSE Container as a Service Platform 2.0 (x86_64)
  • librados2-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • python-rbd-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • libradosstriper1-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • librbd1-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • python-rgw-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • python-rgw-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • python-rados-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • ceph-common-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • librgw2-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • ceph-common-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • python-cephfs-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • python-cephfs-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • ceph-debugsource-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • libcephfs2-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • python-rados-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • python-rbd-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • libcephfs2-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • librados2-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • librgw2-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • librbd1-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • libradosstriper1-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
• SUSE Container as a Service Platform 1.0 (x86_64)
  • librados2-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • python-rbd-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • libradosstriper1-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • librbd1-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • python-rgw-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • python-rgw-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • python-rados-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • ceph-common-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • librgw2-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • ceph-common-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • python-cephfs-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • python-cephfs-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • ceph-debugsource-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • libcephfs2-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • python-rados-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • python-rbd-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • libcephfs2-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • librados2-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • librgw2-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • librbd1-12.2.5+git.1524775272.5e7ea8cf03-2.7.1
  • libradosstriper1-debuginfo-12.2.5+git.1524775272.5e7ea8cf03-2.7.1

References:

• https://www.suse.com/security/cve/CVE-2017-16818.html
• https://www.suse.com/security/cve/CVE-2018-7262.html
• https://bugzilla.suse.com/show_bug.cgi?id=1051598
• https://bugzilla.suse.com/show_bug.cgi?id=1054061
• https://bugzilla.suse.com/show_bug.cgi?id=1056125
• https://bugzilla.suse.com/show_bug.cgi?id=1056967
• https://bugzilla.suse.com/show_bug.cgi?id=1059458
• https://bugzilla.suse.com/show_bug.cgi?id=1060904
• https://bugzilla.suse.com/show_bug.cgi?id=1061461
• https://bugzilla.suse.com/show_bug.cgi?id=1063014
• https://bugzilla.suse.com/show_bug.cgi?id=1066182
• https://bugzilla.suse.com/show_bug.cgi?id=1066502
• https://bugzilla.suse.com/show_bug.cgi?id=1067088
• https://bugzilla.suse.com/show_bug.cgi?id=1067119
• https://bugzilla.suse.com/show_bug.cgi?id=1067705
• https://bugzilla.suse.com/show_bug.cgi?id=1070357
• https://bugzilla.suse.com/show_bug.cgi?id=1071386
• https://bugzilla.suse.com/show_bug.cgi?id=1074301
• https://bugzilla.suse.com/show_bug.cgi?id=1079076
• https://bugzilla.suse.com/show_bug.cgi?id=1080788
• https://bugzilla.suse.com/show_bug.cgi?id=1081379
• https://bugzilla.suse.com/show_bug.cgi?id=1081600
• https://bugzilla.suse.com/show_bug.cgi?id=1086340
• https://bugzilla.suse.com/show_bug.cgi?id=1087269
• https://bugzilla.suse.com/show_bug.cgi?id=1087493