Security update for ceph SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2021:0672-1 Final 1 1 2021-05-06T07:22:17Z current 2021-05-06T07:22:17Z 2021-05-06T07:22:17Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for ceph This update for ceph fixes the following issues: - ceph was updated to 15.2.11-83-g8a15f484c2: * CVE-2021-20288: Fixed unauthorized global_id reuse (bsc#1183074). * disk gets replaced with no rocksdb/wal (bsc#1184231). * BlueStore handles huge(>4GB) writes from RocksDB to BlueFS poorly, potentially causing data corruption (bsc#1183899). This update was imported from the SUSE:SLE-15-SP2:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2021-672 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/F27MV75T6ENOALLCPSWOQKELO26I3HCZ/ E-Mail link for openSUSE-SU-2021:0672-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1183074 SUSE Bug 1183074 https://bugzilla.suse.com/1183899 SUSE Bug 1183899 https://bugzilla.suse.com/1184231 SUSE Bug 1184231 https://www.suse.com/security/cve/CVE-2021-20288/ SUSE CVE CVE-2021-20288 page openSUSE Leap 15.2 ceph-15.2.11.83+g8a15f484c2-lp152.2.15.1 ceph-base-15.2.11.83+g8a15f484c2-lp152.2.15.1 ceph-common-15.2.11.83+g8a15f484c2-lp152.2.15.1 ceph-fuse-15.2.11.83+g8a15f484c2-lp152.2.15.1 ceph-grafana-dashboards-15.2.11.83+g8a15f484c2-lp152.2.15.1 ceph-immutable-object-cache-15.2.11.83+g8a15f484c2-lp152.2.15.1 ceph-mds-15.2.11.83+g8a15f484c2-lp152.2.15.1 ceph-mgr-15.2.11.83+g8a15f484c2-lp152.2.15.1 ceph-mgr-cephadm-15.2.11.83+g8a15f484c2-lp152.2.15.1 ceph-mgr-dashboard-15.2.11.83+g8a15f484c2-lp152.2.15.1 ceph-mgr-diskprediction-cloud-15.2.11.83+g8a15f484c2-lp152.2.15.1 ceph-mgr-diskprediction-local-15.2.11.83+g8a15f484c2-lp152.2.15.1 ceph-mgr-k8sevents-15.2.11.83+g8a15f484c2-lp152.2.15.1 ceph-mgr-modules-core-15.2.11.83+g8a15f484c2-lp152.2.15.1 ceph-mgr-rook-15.2.11.83+g8a15f484c2-lp152.2.15.1 ceph-mon-15.2.11.83+g8a15f484c2-lp152.2.15.1 ceph-osd-15.2.11.83+g8a15f484c2-lp152.2.15.1 ceph-prometheus-alerts-15.2.11.83+g8a15f484c2-lp152.2.15.1 ceph-radosgw-15.2.11.83+g8a15f484c2-lp152.2.15.1 ceph-test-15.2.11.83+g8a15f484c2-lp152.2.15.1 cephadm-15.2.11.83+g8a15f484c2-lp152.2.15.1 cephfs-shell-15.2.11.83+g8a15f484c2-lp152.2.15.1 libcephfs-devel-15.2.11.83+g8a15f484c2-lp152.2.15.1 libcephfs2-15.2.11.83+g8a15f484c2-lp152.2.15.1 librados-devel-15.2.11.83+g8a15f484c2-lp152.2.15.1 librados2-15.2.11.83+g8a15f484c2-lp152.2.15.1 libradospp-devel-15.2.11.83+g8a15f484c2-lp152.2.15.1 librbd-devel-15.2.11.83+g8a15f484c2-lp152.2.15.1 librbd1-15.2.11.83+g8a15f484c2-lp152.2.15.1 librgw-devel-15.2.11.83+g8a15f484c2-lp152.2.15.1 librgw2-15.2.11.83+g8a15f484c2-lp152.2.15.1 python3-ceph-argparse-15.2.11.83+g8a15f484c2-lp152.2.15.1 python3-ceph-common-15.2.11.83+g8a15f484c2-lp152.2.15.1 python3-cephfs-15.2.11.83+g8a15f484c2-lp152.2.15.1 python3-rados-15.2.11.83+g8a15f484c2-lp152.2.15.1 python3-rbd-15.2.11.83+g8a15f484c2-lp152.2.15.1 python3-rgw-15.2.11.83+g8a15f484c2-lp152.2.15.1 rados-objclass-devel-15.2.11.83+g8a15f484c2-lp152.2.15.1 rbd-fuse-15.2.11.83+g8a15f484c2-lp152.2.15.1 rbd-mirror-15.2.11.83+g8a15f484c2-lp152.2.15.1 rbd-nbd-15.2.11.83+g8a15f484c2-lp152.2.15.1 ceph-15.2.11.83+g8a15f484c2-lp152.2.15.1 as a component of openSUSE Leap 15.2 ceph-base-15.2.11.83+g8a15f484c2-lp152.2.15.1 as a component of openSUSE Leap 15.2 ceph-common-15.2.11.83+g8a15f484c2-lp152.2.15.1 as a component of openSUSE Leap 15.2 ceph-fuse-15.2.11.83+g8a15f484c2-lp152.2.15.1 as a component of openSUSE Leap 15.2 ceph-grafana-dashboards-15.2.11.83+g8a15f484c2-lp152.2.15.1 as a component of openSUSE Leap 15.2 ceph-immutable-object-cache-15.2.11.83+g8a15f484c2-lp152.2.15.1 as a component of openSUSE Leap 15.2 ceph-mds-15.2.11.83+g8a15f484c2-lp152.2.15.1 as a component of openSUSE Leap 15.2 ceph-mgr-15.2.11.83+g8a15f484c2-lp152.2.15.1 as a component of openSUSE Leap 15.2 ceph-mgr-cephadm-15.2.11.83+g8a15f484c2-lp152.2.15.1 as a component of openSUSE Leap 15.2 ceph-mgr-dashboard-15.2.11.83+g8a15f484c2-lp152.2.15.1 as a component of openSUSE Leap 15.2 ceph-mgr-diskprediction-cloud-15.2.11.83+g8a15f484c2-lp152.2.15.1 as a component of openSUSE Leap 15.2 ceph-mgr-diskprediction-local-15.2.11.83+g8a15f484c2-lp152.2.15.1 as a component of openSUSE Leap 15.2 ceph-mgr-k8sevents-15.2.11.83+g8a15f484c2-lp152.2.15.1 as a component of openSUSE Leap 15.2 ceph-mgr-modules-core-15.2.11.83+g8a15f484c2-lp152.2.15.1 as a component of openSUSE Leap 15.2 ceph-mgr-rook-15.2.11.83+g8a15f484c2-lp152.2.15.1 as a component of openSUSE Leap 15.2 ceph-mon-15.2.11.83+g8a15f484c2-lp152.2.15.1 as a component of openSUSE Leap 15.2 ceph-osd-15.2.11.83+g8a15f484c2-lp152.2.15.1 as a component of openSUSE Leap 15.2 ceph-prometheus-alerts-15.2.11.83+g8a15f484c2-lp152.2.15.1 as a component of openSUSE Leap 15.2 ceph-radosgw-15.2.11.83+g8a15f484c2-lp152.2.15.1 as a component of openSUSE Leap 15.2 ceph-test-15.2.11.83+g8a15f484c2-lp152.2.15.1 as a component of openSUSE Leap 15.2 cephadm-15.2.11.83+g8a15f484c2-lp152.2.15.1 as a component of openSUSE Leap 15.2 cephfs-shell-15.2.11.83+g8a15f484c2-lp152.2.15.1 as a component of openSUSE Leap 15.2 libcephfs-devel-15.2.11.83+g8a15f484c2-lp152.2.15.1 as a component of openSUSE Leap 15.2 libcephfs2-15.2.11.83+g8a15f484c2-lp152.2.15.1 as a component of openSUSE Leap 15.2 librados-devel-15.2.11.83+g8a15f484c2-lp152.2.15.1 as a component of openSUSE Leap 15.2 librados2-15.2.11.83+g8a15f484c2-lp152.2.15.1 as a component of openSUSE Leap 15.2 libradospp-devel-15.2.11.83+g8a15f484c2-lp152.2.15.1 as a component of openSUSE Leap 15.2 librbd-devel-15.2.11.83+g8a15f484c2-lp152.2.15.1 as a component of openSUSE Leap 15.2 librbd1-15.2.11.83+g8a15f484c2-lp152.2.15.1 as a component of openSUSE Leap 15.2 librgw-devel-15.2.11.83+g8a15f484c2-lp152.2.15.1 as a component of openSUSE Leap 15.2 librgw2-15.2.11.83+g8a15f484c2-lp152.2.15.1 as a component of openSUSE Leap 15.2 python3-ceph-argparse-15.2.11.83+g8a15f484c2-lp152.2.15.1 as a component of openSUSE Leap 15.2 python3-ceph-common-15.2.11.83+g8a15f484c2-lp152.2.15.1 as a component of openSUSE Leap 15.2 python3-cephfs-15.2.11.83+g8a15f484c2-lp152.2.15.1 as a component of openSUSE Leap 15.2 python3-rados-15.2.11.83+g8a15f484c2-lp152.2.15.1 as a component of openSUSE Leap 15.2 python3-rbd-15.2.11.83+g8a15f484c2-lp152.2.15.1 as a component of openSUSE Leap 15.2 python3-rgw-15.2.11.83+g8a15f484c2-lp152.2.15.1 as a component of openSUSE Leap 15.2 rados-objclass-devel-15.2.11.83+g8a15f484c2-lp152.2.15.1 as a component of openSUSE Leap 15.2 rbd-fuse-15.2.11.83+g8a15f484c2-lp152.2.15.1 as a component of openSUSE Leap 15.2 rbd-mirror-15.2.11.83+g8a15f484c2-lp152.2.15.1 as a component of openSUSE Leap 15.2 rbd-nbd-15.2.11.83+g8a15f484c2-lp152.2.15.1 as a component of openSUSE Leap 15.2 An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse. An attacker who can request a global_id can exploit the ability of any user to request a global_id previously associated with another user, as ceph does not force the reuse of old keys to generate new ones. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. CVE-2021-20288 openSUSE Leap 15.2:ceph-15.2.11.83+g8a15f484c2-lp152.2.15.1 openSUSE Leap 15.2:ceph-base-15.2.11.83+g8a15f484c2-lp152.2.15.1 openSUSE Leap 15.2:ceph-common-15.2.11.83+g8a15f484c2-lp152.2.15.1 openSUSE Leap 15.2:ceph-fuse-15.2.11.83+g8a15f484c2-lp152.2.15.1 openSUSE Leap 15.2:ceph-grafana-dashboards-15.2.11.83+g8a15f484c2-lp152.2.15.1 openSUSE Leap 15.2:ceph-immutable-object-cache-15.2.11.83+g8a15f484c2-lp152.2.15.1 openSUSE Leap 15.2:ceph-mds-15.2.11.83+g8a15f484c2-lp152.2.15.1 openSUSE Leap 15.2:ceph-mgr-15.2.11.83+g8a15f484c2-lp152.2.15.1 openSUSE Leap 15.2:ceph-mgr-cephadm-15.2.11.83+g8a15f484c2-lp152.2.15.1 openSUSE Leap 15.2:ceph-mgr-dashboard-15.2.11.83+g8a15f484c2-lp152.2.15.1 openSUSE Leap 15.2:ceph-mgr-diskprediction-cloud-15.2.11.83+g8a15f484c2-lp152.2.15.1 openSUSE Leap 15.2:ceph-mgr-diskprediction-local-15.2.11.83+g8a15f484c2-lp152.2.15.1 openSUSE Leap 15.2:ceph-mgr-k8sevents-15.2.11.83+g8a15f484c2-lp152.2.15.1 openSUSE Leap 15.2:ceph-mgr-modules-core-15.2.11.83+g8a15f484c2-lp152.2.15.1 openSUSE Leap 15.2:ceph-mgr-rook-15.2.11.83+g8a15f484c2-lp152.2.15.1 openSUSE Leap 15.2:ceph-mon-15.2.11.83+g8a15f484c2-lp152.2.15.1 openSUSE Leap 15.2:ceph-osd-15.2.11.83+g8a15f484c2-lp152.2.15.1 openSUSE Leap 15.2:ceph-prometheus-alerts-15.2.11.83+g8a15f484c2-lp152.2.15.1 openSUSE Leap 15.2:ceph-radosgw-15.2.11.83+g8a15f484c2-lp152.2.15.1 openSUSE Leap 15.2:ceph-test-15.2.11.83+g8a15f484c2-lp152.2.15.1 openSUSE Leap 15.2:cephadm-15.2.11.83+g8a15f484c2-lp152.2.15.1 openSUSE Leap 15.2:cephfs-shell-15.2.11.83+g8a15f484c2-lp152.2.15.1 openSUSE Leap 15.2:libcephfs-devel-15.2.11.83+g8a15f484c2-lp152.2.15.1 openSUSE Leap 15.2:libcephfs2-15.2.11.83+g8a15f484c2-lp152.2.15.1 openSUSE Leap 15.2:librados-devel-15.2.11.83+g8a15f484c2-lp152.2.15.1 openSUSE Leap 15.2:librados2-15.2.11.83+g8a15f484c2-lp152.2.15.1 openSUSE Leap 15.2:libradospp-devel-15.2.11.83+g8a15f484c2-lp152.2.15.1 openSUSE Leap 15.2:librbd-devel-15.2.11.83+g8a15f484c2-lp152.2.15.1 openSUSE Leap 15.2:librbd1-15.2.11.83+g8a15f484c2-lp152.2.15.1 openSUSE Leap 15.2:librgw-devel-15.2.11.83+g8a15f484c2-lp152.2.15.1 openSUSE Leap 15.2:librgw2-15.2.11.83+g8a15f484c2-lp152.2.15.1 openSUSE Leap 15.2:python3-ceph-argparse-15.2.11.83+g8a15f484c2-lp152.2.15.1 openSUSE Leap 15.2:python3-ceph-common-15.2.11.83+g8a15f484c2-lp152.2.15.1 openSUSE Leap 15.2:python3-cephfs-15.2.11.83+g8a15f484c2-lp152.2.15.1 openSUSE Leap 15.2:python3-rados-15.2.11.83+g8a15f484c2-lp152.2.15.1 openSUSE Leap 15.2:python3-rbd-15.2.11.83+g8a15f484c2-lp152.2.15.1 openSUSE Leap 15.2:python3-rgw-15.2.11.83+g8a15f484c2-lp152.2.15.1 openSUSE Leap 15.2:rados-objclass-devel-15.2.11.83+g8a15f484c2-lp152.2.15.1 openSUSE Leap 15.2:rbd-fuse-15.2.11.83+g8a15f484c2-lp152.2.15.1 openSUSE Leap 15.2:rbd-mirror-15.2.11.83+g8a15f484c2-lp152.2.15.1 openSUSE Leap 15.2:rbd-nbd-15.2.11.83+g8a15f484c2-lp152.2.15.1 important 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/F27MV75T6ENOALLCPSWOQKELO26I3HCZ/ https://www.suse.com/security/cve/CVE-2021-20288.html CVE-2021-20288 https://bugzilla.suse.com/1183074 SUSE Bug 1183074 https://bugzilla.suse.com/1205049 SUSE Bug 1205049