Security update for ceph SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2017:3171-1 Final 1 1 2017-12-01T10:31:17Z current 2017-12-01T10:31:17Z 2017-12-01T10:31:17Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for ceph This update provides Ceph 10.2.10, which brings fixes and enhancements: This security issue was fixed: - CVE-2017-7519: libradosstriper processes arbitrary printf placeholders in user input. (bsc#1043767) - CVE-2016-9579: Do not abort RGW server when accepting a CORS request with short origin. (bsc#1014986) These non-security issues were fixed: - common: Add rdbmap to ceph-common. (bsc#1029482) - tools/rados: Default to include clone objects when executing 'cache-flush-evict-all'. (bsc#1003891) - mon, ceph-disk: Add lockbox permissions to bootstrap-osd. (bsc#1008435) - ceph_volume_client: Fix _recover_auth_meta() method. (bsc#1008501) - systemd/ceph-disk: Reduce ceph-disk flock contention. (bsc#1012100) - doc: Add verbiage to rbdmap manpage. (bsc#1015748) - doc: Add Install section to systemd rbdmap.service file. (bsc#1015748) - ceph systemd dependencies are wrong (bsc#1042973) - ceph-disk omits '--runtime' when enabling ceph-osd units (was: ERROR: unable to open OSD superblock) (bsc#1051598) - SES4: 23 osd's are down after patching node. (bsc#1056536) - Invalid error code returned by MDS is causing a kernel client WARNING (bsc#1028109) - systemctl stop rbdmap unmaps ALL rbds and not just the ones in /etc/ceph/rbdmap (bsc#1024691) - documentation: man crushtool does not cover the '--show-mappings' parameter (bsc#1033786) - swift | This returns with HTTP/1.1 401 Unauthorized (bsc#1015371) - OSDs fail to start after server reboot (bsc#1025643) - 'ceph-deploy mds destroy' not implemented (bsc#970642) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-Storage-3-2017-1975 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2017/suse-su-20173171-1/ Link for SUSE-SU-2017:3171-1 https://lists.suse.com/pipermail/sle-security-updates/2017-December/003463.html E-Mail link for SUSE-SU-2017:3171-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1003891 SUSE Bug 1003891 https://bugzilla.suse.com/1008435 SUSE Bug 1008435 https://bugzilla.suse.com/1008501 SUSE Bug 1008501 https://bugzilla.suse.com/1012100 SUSE Bug 1012100 https://bugzilla.suse.com/1014986 SUSE Bug 1014986 https://bugzilla.suse.com/1015371 SUSE Bug 1015371 https://bugzilla.suse.com/1015748 SUSE Bug 1015748 https://bugzilla.suse.com/1024691 SUSE Bug 1024691 https://bugzilla.suse.com/1025643 SUSE Bug 1025643 https://bugzilla.suse.com/1028109 SUSE Bug 1028109 https://bugzilla.suse.com/1029482 SUSE Bug 1029482 https://bugzilla.suse.com/1033786 SUSE Bug 1033786 https://bugzilla.suse.com/1042973 SUSE Bug 1042973 https://bugzilla.suse.com/1043767 SUSE Bug 1043767 https://bugzilla.suse.com/1051598 SUSE Bug 1051598 https://bugzilla.suse.com/1056536 SUSE Bug 1056536 https://bugzilla.suse.com/970642 SUSE Bug 970642 https://www.suse.com/security/cve/CVE-2016-9579/ SUSE CVE CVE-2016-9579 page https://www.suse.com/security/cve/CVE-2017-7519/ SUSE CVE CVE-2017-7519 page SUSE Enterprise Storage 3 ceph-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 ceph-base-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 ceph-common-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 ceph-fuse-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 ceph-mds-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 ceph-mon-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 ceph-osd-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 ceph-radosgw-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 ceph-test-10.2.10+git.1510313171.6d5f0aeac1-13.7.2 libcephfs1-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 librados2-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 libradosstriper1-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 librbd1-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 librgw2-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 python-ceph-compat-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 python-cephfs-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 python-rados-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 python-rbd-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 rbd-fuse-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 rbd-mirror-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 rbd-nbd-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 ceph-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 as a component of SUSE Enterprise Storage 3 ceph-base-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 as a component of SUSE Enterprise Storage 3 ceph-common-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 as a component of SUSE Enterprise Storage 3 ceph-fuse-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 as a component of SUSE Enterprise Storage 3 ceph-mds-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 as a component of SUSE Enterprise Storage 3 ceph-mon-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 as a component of SUSE Enterprise Storage 3 ceph-osd-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 as a component of SUSE Enterprise Storage 3 ceph-radosgw-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 as a component of SUSE Enterprise Storage 3 ceph-test-10.2.10+git.1510313171.6d5f0aeac1-13.7.2 as a component of SUSE Enterprise Storage 3 libcephfs1-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 as a component of SUSE Enterprise Storage 3 librados2-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 as a component of SUSE Enterprise Storage 3 libradosstriper1-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 as a component of SUSE Enterprise Storage 3 librbd1-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 as a component of SUSE Enterprise Storage 3 librgw2-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 as a component of SUSE Enterprise Storage 3 python-ceph-compat-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 as a component of SUSE Enterprise Storage 3 python-cephfs-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 as a component of SUSE Enterprise Storage 3 python-rados-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 as a component of SUSE Enterprise Storage 3 python-rbd-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 as a component of SUSE Enterprise Storage 3 rbd-fuse-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 as a component of SUSE Enterprise Storage 3 rbd-mirror-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 as a component of SUSE Enterprise Storage 3 rbd-nbd-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 as a component of SUSE Enterprise Storage 3 A flaw was found in the way Ceph Object Gateway would process cross-origin HTTP requests if the CORS policy was set to allow origin on a bucket. A remote unauthenticated attacker could use this flaw to cause denial of service by sending a specially-crafted cross-origin HTTP request. Ceph branches 1.3.x and 2.x are affected. CVE-2016-9579 SUSE Enterprise Storage 3:ceph-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 SUSE Enterprise Storage 3:ceph-base-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 SUSE Enterprise Storage 3:ceph-common-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 SUSE Enterprise Storage 3:ceph-fuse-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 SUSE Enterprise Storage 3:ceph-mds-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 SUSE Enterprise Storage 3:ceph-mon-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 SUSE Enterprise Storage 3:ceph-osd-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 SUSE Enterprise Storage 3:ceph-radosgw-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 SUSE Enterprise Storage 3:ceph-test-10.2.10+git.1510313171.6d5f0aeac1-13.7.2 SUSE Enterprise Storage 3:libcephfs1-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 SUSE Enterprise Storage 3:librados2-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 SUSE Enterprise Storage 3:libradosstriper1-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 SUSE Enterprise Storage 3:librbd1-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 SUSE Enterprise Storage 3:librgw2-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 SUSE Enterprise Storage 3:python-ceph-compat-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 SUSE Enterprise Storage 3:python-cephfs-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 SUSE Enterprise Storage 3:python-rados-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 SUSE Enterprise Storage 3:python-rbd-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 SUSE Enterprise Storage 3:rbd-fuse-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 SUSE Enterprise Storage 3:rbd-mirror-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 SUSE Enterprise Storage 3:rbd-nbd-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 low 3.5 AV:N/AC:M/Au:S/C:N/I:N/A:P 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20173171-1/ https://www.suse.com/security/cve/CVE-2016-9579.html CVE-2016-9579 https://bugzilla.suse.com/1014986 SUSE Bug 1014986 In Ceph, a format string flaw was found in the way libradosstriper parses input from user. A user could crash an application or service using the libradosstriper library. CVE-2017-7519 SUSE Enterprise Storage 3:ceph-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 SUSE Enterprise Storage 3:ceph-base-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 SUSE Enterprise Storage 3:ceph-common-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 SUSE Enterprise Storage 3:ceph-fuse-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 SUSE Enterprise Storage 3:ceph-mds-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 SUSE Enterprise Storage 3:ceph-mon-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 SUSE Enterprise Storage 3:ceph-osd-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 SUSE Enterprise Storage 3:ceph-radosgw-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 SUSE Enterprise Storage 3:ceph-test-10.2.10+git.1510313171.6d5f0aeac1-13.7.2 SUSE Enterprise Storage 3:libcephfs1-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 SUSE Enterprise Storage 3:librados2-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 SUSE Enterprise Storage 3:libradosstriper1-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 SUSE Enterprise Storage 3:librbd1-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 SUSE Enterprise Storage 3:librgw2-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 SUSE Enterprise Storage 3:python-ceph-compat-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 SUSE Enterprise Storage 3:python-cephfs-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 SUSE Enterprise Storage 3:python-rados-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 SUSE Enterprise Storage 3:python-rbd-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 SUSE Enterprise Storage 3:rbd-fuse-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 SUSE Enterprise Storage 3:rbd-mirror-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 SUSE Enterprise Storage 3:rbd-nbd-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 moderate 3.5 AV:N/AC:M/Au:S/C:N/I:N/A:P 2.1 AV:L/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20173171-1/ https://www.suse.com/security/cve/CVE-2017-7519.html CVE-2017-7519 https://bugzilla.suse.com/1043767 SUSE Bug 1043767