Security update for ceph SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2018:2479-1 Final 1 1 2018-05-30T08:26:18Z current 2018-05-30T08:26:18Z 2018-05-30T08:26:18Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for ceph This update for ceph fixes the following issues: Security issues fixed: - CVE-2018-7262: rgw: malformed http headers can crash rgw (bsc#1081379). - CVE-2017-16818: User reachable asserts allow for DoS (bsc#1063014). Bug fixes: - bsc#1061461: OSDs keep generating coredumps after adding new OSD node to cluster. - bsc#1079076: RGW openssl fixes. - bsc#1067088: Upgrade to SES5 restarted all nodes, majority of OSDs aborts during start. - bsc#1056125: Some OSDs are down when doing performance testing on rbd image in EC Pool. - bsc#1087269: allow_ec_overwrites option not in command options list. - bsc#1051598: Fix mountpoint check for systemctl enable --runtime. - bsc#1070357: Zabbix mgr module doesn't recover from HEALTH_ERR. - bsc#1066502: After upgrading a single OSD from SES 4 to SES 5 the OSDs do not rejoin the cluster. - bsc#1067119: Crushtool decompile creates wrong device entries (device 20 device20) for not existing / deleted OSDs. - bsc#1060904: Loglevel misleading during keystone authentication. - bsc#1056967: Monitors goes down after pool creation on cluster with 120 OSDs. - bsc#1067705: Issues with RGW Multi-Site Federation between SES5 and RH Ceph Storage 2. - bsc#1059458: Stopping / restarting rados gateway as part of deepsea stage.4 executions causes core-dump of radosgw. - bsc#1087493: Commvault cannot reconnect to storage after restarting haproxy. - bsc#1066182: Container synchronization between two Ceph clusters failed. - bsc#1081600: Crash in civetweb/RGW. - bsc#1054061: NFS-GANESHA service failing while trying to list mountpoint on client. - bsc#1074301: OSDs keep aborting: SnapMapper failed asserts. - bsc#1086340: XFS metadata corruption on rbd-nbd mapped image with journaling feature enabled. - bsc#1080788: fsid mismatch when creating additional OSDs. - bsc#1071386: Metadata spill onto block.slow. This update was imported from the SUSE:SLE-12-SP3:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/opensuse-security-announce/2018-08/msg00071.html E-Mail link for openSUSE-SU-2018:2479-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE Leap 42.3 ceph-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-base-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-common-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-fuse-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-mds-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-mgr-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-mon-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-osd-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-radosgw-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-resource-agents-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-test-12.2.5+git.1524775272.5e7ea8cf03-9.1 libcephfs-devel-12.2.5+git.1524775272.5e7ea8cf03-9.1 libcephfs2-12.2.5+git.1524775272.5e7ea8cf03-9.1 librados-devel-12.2.5+git.1524775272.5e7ea8cf03-9.1 librados2-12.2.5+git.1524775272.5e7ea8cf03-9.1 libradosstriper-devel-12.2.5+git.1524775272.5e7ea8cf03-9.1 libradosstriper1-12.2.5+git.1524775272.5e7ea8cf03-9.1 librbd-devel-12.2.5+git.1524775272.5e7ea8cf03-9.1 librbd1-12.2.5+git.1524775272.5e7ea8cf03-9.1 librgw-devel-12.2.5+git.1524775272.5e7ea8cf03-9.1 librgw2-12.2.5+git.1524775272.5e7ea8cf03-9.1 python-ceph-compat-12.2.5+git.1524775272.5e7ea8cf03-9.1 python-cephfs-12.2.5+git.1524775272.5e7ea8cf03-9.1 python-rados-12.2.5+git.1524775272.5e7ea8cf03-9.1 python-rbd-12.2.5+git.1524775272.5e7ea8cf03-9.1 python-rgw-12.2.5+git.1524775272.5e7ea8cf03-9.1 python3-ceph-argparse-12.2.5+git.1524775272.5e7ea8cf03-9.1 python3-cephfs-12.2.5+git.1524775272.5e7ea8cf03-9.1 python3-rados-12.2.5+git.1524775272.5e7ea8cf03-9.1 python3-rbd-12.2.5+git.1524775272.5e7ea8cf03-9.1 python3-rgw-12.2.5+git.1524775272.5e7ea8cf03-9.1 rados-objclass-devel-12.2.5+git.1524775272.5e7ea8cf03-9.1 rbd-fuse-12.2.5+git.1524775272.5e7ea8cf03-9.1 rbd-mirror-12.2.5+git.1524775272.5e7ea8cf03-9.1 rbd-nbd-12.2.5+git.1524775272.5e7ea8cf03-9.1 ceph-12.2.5+git.1524775272.5e7ea8cf03-9.1 as a component of openSUSE Leap 42.3 ceph-base-12.2.5+git.1524775272.5e7ea8cf03-9.1 as a component of openSUSE Leap 42.3 ceph-common-12.2.5+git.1524775272.5e7ea8cf03-9.1 as a component of openSUSE Leap 42.3 ceph-fuse-12.2.5+git.1524775272.5e7ea8cf03-9.1 as a component of openSUSE Leap 42.3 ceph-mds-12.2.5+git.1524775272.5e7ea8cf03-9.1 as a component of openSUSE Leap 42.3 ceph-mgr-12.2.5+git.1524775272.5e7ea8cf03-9.1 as a component of openSUSE Leap 42.3 ceph-mon-12.2.5+git.1524775272.5e7ea8cf03-9.1 as a component of openSUSE Leap 42.3 ceph-osd-12.2.5+git.1524775272.5e7ea8cf03-9.1 as a component of openSUSE Leap 42.3 ceph-radosgw-12.2.5+git.1524775272.5e7ea8cf03-9.1 as a component of openSUSE Leap 42.3 ceph-resource-agents-12.2.5+git.1524775272.5e7ea8cf03-9.1 as a component of openSUSE Leap 42.3 ceph-test-12.2.5+git.1524775272.5e7ea8cf03-9.1 as a component of openSUSE Leap 42.3 libcephfs-devel-12.2.5+git.1524775272.5e7ea8cf03-9.1 as a component of openSUSE Leap 42.3 libcephfs2-12.2.5+git.1524775272.5e7ea8cf03-9.1 as a component of openSUSE Leap 42.3 librados-devel-12.2.5+git.1524775272.5e7ea8cf03-9.1 as a component of openSUSE Leap 42.3 librados2-12.2.5+git.1524775272.5e7ea8cf03-9.1 as a component of openSUSE Leap 42.3 libradosstriper-devel-12.2.5+git.1524775272.5e7ea8cf03-9.1 as a component of openSUSE Leap 42.3 libradosstriper1-12.2.5+git.1524775272.5e7ea8cf03-9.1 as a component of openSUSE Leap 42.3 librbd-devel-12.2.5+git.1524775272.5e7ea8cf03-9.1 as a component of openSUSE Leap 42.3 librbd1-12.2.5+git.1524775272.5e7ea8cf03-9.1 as a component of openSUSE Leap 42.3 librgw-devel-12.2.5+git.1524775272.5e7ea8cf03-9.1 as a component of openSUSE Leap 42.3 librgw2-12.2.5+git.1524775272.5e7ea8cf03-9.1 as a component of openSUSE Leap 42.3 python-ceph-compat-12.2.5+git.1524775272.5e7ea8cf03-9.1 as a component of openSUSE Leap 42.3 python-cephfs-12.2.5+git.1524775272.5e7ea8cf03-9.1 as a component of openSUSE Leap 42.3 python-rados-12.2.5+git.1524775272.5e7ea8cf03-9.1 as a component of openSUSE Leap 42.3 python-rbd-12.2.5+git.1524775272.5e7ea8cf03-9.1 as a component of openSUSE Leap 42.3 python-rgw-12.2.5+git.1524775272.5e7ea8cf03-9.1 as a component of openSUSE Leap 42.3 python3-ceph-argparse-12.2.5+git.1524775272.5e7ea8cf03-9.1 as a component of openSUSE Leap 42.3 python3-cephfs-12.2.5+git.1524775272.5e7ea8cf03-9.1 as a component of openSUSE Leap 42.3 python3-rados-12.2.5+git.1524775272.5e7ea8cf03-9.1 as a component of openSUSE Leap 42.3 python3-rbd-12.2.5+git.1524775272.5e7ea8cf03-9.1 as a component of openSUSE Leap 42.3 python3-rgw-12.2.5+git.1524775272.5e7ea8cf03-9.1 as a component of openSUSE Leap 42.3 rados-objclass-devel-12.2.5+git.1524775272.5e7ea8cf03-9.1 as a component of openSUSE Leap 42.3 rbd-fuse-12.2.5+git.1524775272.5e7ea8cf03-9.1 as a component of openSUSE Leap 42.3 rbd-mirror-12.2.5+git.1524775272.5e7ea8cf03-9.1 as a component of openSUSE Leap 42.3 rbd-nbd-12.2.5+git.1524775272.5e7ea8cf03-9.1 as a component of openSUSE Leap 42.3 RADOS Gateway in Ceph 12.1.0 through 12.2.1 allows remote authenticated users to cause a denial of service (assertion failure and application exit) by leveraging "full" (not necessarily admin) privileges to post an invalid profile to the admin API, related to rgw/rgw_iam_policy.cc, rgw/rgw_basic_types.h, and rgw/rgw_iam_types.h. CVE-2017-16818 openSUSE Leap 42.3:ceph-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:ceph-base-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:ceph-common-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:ceph-fuse-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:ceph-mds-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:ceph-mgr-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:ceph-mon-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:ceph-osd-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:ceph-radosgw-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:ceph-resource-agents-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:ceph-test-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:libcephfs-devel-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:libcephfs2-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:librados-devel-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:librados2-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:libradosstriper-devel-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:libradosstriper1-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:librbd-devel-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:librbd1-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:librgw-devel-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:librgw2-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:python-ceph-compat-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:python-cephfs-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:python-rados-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:python-rbd-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:python-rgw-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:python3-ceph-argparse-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:python3-cephfs-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:python3-rados-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:python3-rbd-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:python3-rgw-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:rados-objclass-devel-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:rbd-fuse-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:rbd-mirror-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:rbd-nbd-12.2.5+git.1524775272.5e7ea8cf03-9.1 moderate 6.8 AV:N/AC:L/Au:S/C:N/I:N/A:C Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2018-08/msg00071.html https://www.suse.com/security/cve/CVE-2017-16818.html CVE-2017-16818 https://bugzilla.suse.com/1063014 SUSE Bug 1063014 https://bugzilla.suse.com/1069253 SUSE Bug 1069253 In Ceph before 12.2.3 and 13.x through 13.0.1, the rgw_civetweb.cc RGWCivetWeb::init_env function in radosgw doesn't handle malformed HTTP headers properly, allowing for denial of service. CVE-2018-7262 openSUSE Leap 42.3:ceph-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:ceph-base-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:ceph-common-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:ceph-fuse-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:ceph-mds-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:ceph-mgr-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:ceph-mon-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:ceph-osd-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:ceph-radosgw-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:ceph-resource-agents-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:ceph-test-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:libcephfs-devel-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:libcephfs2-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:librados-devel-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:librados2-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:libradosstriper-devel-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:libradosstriper1-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:librbd-devel-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:librbd1-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:librgw-devel-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:librgw2-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:python-ceph-compat-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:python-cephfs-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:python-rados-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:python-rbd-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:python-rgw-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:python3-ceph-argparse-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:python3-cephfs-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:python3-rados-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:python3-rbd-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:python3-rgw-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:rados-objclass-devel-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:rbd-fuse-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:rbd-mirror-12.2.5+git.1524775272.5e7ea8cf03-9.1 openSUSE Leap 42.3:rbd-nbd-12.2.5+git.1524775272.5e7ea8cf03-9.1 important Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2018-08/msg00071.html https://www.suse.com/security/cve/CVE-2018-7262.html CVE-2018-7262 https://bugzilla.suse.com/1081379 SUSE Bug 1081379