Security update for ceph

Announcement ID: SUSE-SU-2023:1584-1
Rating: important
References:
Cross-References:
CVSS scores:
  • CVE-2022-0670 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
  • CVE-2022-0670 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
  • CVE-2022-3650 ( SUSE ): 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
  • CVE-2022-3650 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE-2022-3854 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • CVE-2022-3854 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected Products:
  • SUSE Enterprise Storage 7.1
  • SUSE Linux Enterprise Server 15 SP3

An update that solves three vulnerabilities and has 18 security fixes can now be installed.

Description:

This update for ceph fixes the following issues:

Security issues fixed:

  • CVE-2022-0670: Fixed user/tenant read/write access to an entire file system (bsc#1201837).
  • CVE-2022-3650: Fixed Python script that allowed privilege escalation from ceph to root (bsc#1204430).
  • CVE-2022-3854: Fixed possible DoS issue in ceph URL processing on RGW backends (bsc#1205025).

Bug fixes:

  • osd, tools, kv: non-aggressive, on-line trimming of accumulated dups (bsc#1199183).
  • ceph-volume: fix fast device alloc size on mulitple device (bsc#1200262).
  • cephadm: update monitoring container images (bsc#1200501).
  • mgr/dashboard: prevent alert redirect (bsc#1200978).
  • mgr/volumes: Add subvolumegroup resize cmd (bsc#1201797).
  • monitoring/ceph-mixin: add RGW host to label info (bsc#1201976).
  • mgr/dashboard: enable addition of custom Prometheus alerts (bsc#1202077).
  • python-common: Add 'KB' to supported suffixes in SizeMatcher (bsc#1203375).
  • mgr/dashboard: fix rgw connect when using ssl (bsc#1205436).
  • ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS (bsc#1202292).
  • cephfs-shell: move source to separate subdirectory (bsc#1201604).

Fix in previous release:

  • mgr/cephadm: try to get FQDN for configuration files (bsc#1196046).
  • When an RBD is mapped, it is attempted to be deployed as an OSD. (bsc#1187748).
  • OSD marked down causes wrong backfill_toofull (bsc#1188911).
  • cephadm: Fix iscsi client caps (allow mgr <service status> calls) (bsc#1192838).
  • mgr/cephadm: fix and improve osd draining (bsc#1200317).
  • add iscsi and nfs to upgrade process (bsc#1206158).
  • mgr/mgr_module.py: CLICommand: Fix parsing of kwargs arguments (bsc#1192840).

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  • SUSE Enterprise Storage 7.1
    zypper in -t patch SUSE-Storage-7.1-2023-1584=1

Package List:

  • SUSE Enterprise Storage 7.1 (aarch64 x86_64)
    • python3-rados-16.2.11.58+g38d6afd3b78-150300.3.6.1
    • ceph-base-debuginfo-16.2.11.58+g38d6afd3b78-150300.3.6.1
    • libcephfs2-debuginfo-16.2.11.58+g38d6afd3b78-150300.3.6.1
    • librbd1-debuginfo-16.2.11.58+g38d6afd3b78-150300.3.6.1
    • libcephfs2-16.2.11.58+g38d6afd3b78-150300.3.6.1
    • rbd-nbd-16.2.11.58+g38d6afd3b78-150300.3.6.1
    • python3-rgw-16.2.11.58+g38d6afd3b78-150300.3.6.1
    • librbd1-16.2.11.58+g38d6afd3b78-150300.3.6.1
    • ceph-common-16.2.11.58+g38d6afd3b78-150300.3.6.1
    • python3-rbd-debuginfo-16.2.11.58+g38d6afd3b78-150300.3.6.1
    • ceph-debugsource-16.2.11.58+g38d6afd3b78-150300.3.6.1
    • python3-cephfs-16.2.11.58+g38d6afd3b78-150300.3.6.1
    • librados2-16.2.11.58+g38d6afd3b78-150300.3.6.1
    • ceph-base-16.2.11.58+g38d6afd3b78-150300.3.6.1
    • librgw2-16.2.11.58+g38d6afd3b78-150300.3.6.1
    • librgw2-debuginfo-16.2.11.58+g38d6afd3b78-150300.3.6.1
    • ceph-common-debuginfo-16.2.11.58+g38d6afd3b78-150300.3.6.1
    • python3-ceph-common-16.2.11.58+g38d6afd3b78-150300.3.6.1
    • python3-rgw-debuginfo-16.2.11.58+g38d6afd3b78-150300.3.6.1
    • python3-rados-debuginfo-16.2.11.58+g38d6afd3b78-150300.3.6.1
    • python3-ceph-argparse-16.2.11.58+g38d6afd3b78-150300.3.6.1
    • rbd-nbd-debuginfo-16.2.11.58+g38d6afd3b78-150300.3.6.1
    • librados2-debuginfo-16.2.11.58+g38d6afd3b78-150300.3.6.1
    • python3-rbd-16.2.11.58+g38d6afd3b78-150300.3.6.1
    • python3-cephfs-debuginfo-16.2.11.58+g38d6afd3b78-150300.3.6.1
  • SUSE Enterprise Storage 7.1 (noarch)
    • cephadm-16.2.11.58+g38d6afd3b78-150300.3.6.1

References: