Security update for ceph SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:1417-1 Final 1 1 2018-06-07T13:10:58Z current 2018-06-07T13:10:58Z 2018-06-07T13:10:58Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for ceph This update for ceph fixes the following issues: Security issues fixed: - CVE-2018-7262: rgw: malformed http headers can crash rgw (bsc#1081379). - CVE-2017-16818: User reachable asserts allow for DoS (bsc#1063014). Bug fixes: - bsc#1061461: OSDs keep generating coredumps after adding new OSD node to cluster. - bsc#1079076: RGW openssl fixes. - bsc#1067088: Upgrade to SES5 restarted all nodes, majority of OSDs aborts during start. - bsc#1056125: Some OSDs are down when doing performance testing on rbd image in EC Pool. - bsc#1087269: allow_ec_overwrites option not in command options list. - bsc#1051598: Fix mountpoint check for systemctl enable --runtime. - bsc#1070357: Zabbix mgr module doesn't recover from HEALTH_ERR. - bsc#1066502: After upgrading a single OSD from SES 4 to SES 5 the OSDs do not rejoin the cluster. - bsc#1067119: Crushtool decompile creates wrong device entries (device 20 device20) for not existing / deleted OSDs. - bsc#1060904: Loglevel misleading during keystone authentication. - bsc#1056967: Monitors goes down after pool creation on cluster with 120 OSDs. - bsc#1067705: Issues with RGW Multi-Site Federation between SES5 and RH Ceph Storage 2. - bsc#1059458: Stopping / restarting rados gateway as part of deepsea stage.4 executions causes core-dump of radosgw. - bsc#1087493: Commvault cannot reconnect to storage after restarting haproxy. - bsc#1066182: Container synchronization between two Ceph clusters failed. - bsc#1081600: Crash in civetweb/RGW. - bsc#1054061: NFS-GANESHA service failing while trying to list mountpoint on client. - bsc#1074301: OSDs keep aborting: SnapMapper failed asserts. - bsc#1086340: XFS metadata corruption on rbd-nbd mapped image with journaling feature enabled. - bsc#1080788: fsid mismatch when creating additional OSDs. - bsc#1071386: Metadata spill onto block.slow. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-DESKTOP-12-SP3-2018-980,SUSE-SLE-SDK-12-SP3-2018-980,SUSE-SLE-SERVER-12-SP3-2018-980 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20181417-1/ Link for SUSE-SU-2018:1417-1 https://lists.suse.com/pipermail/sle-security-updates/2018-May/004086.html E-Mail link for SUSE-SU-2018:1417-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1051598 SUSE Bug 1051598 https://bugzilla.suse.com/1054061 SUSE Bug 1054061 https://bugzilla.suse.com/1056125 SUSE Bug 1056125 https://bugzilla.suse.com/1056967 SUSE Bug 1056967 https://bugzilla.suse.com/1059458 SUSE Bug 1059458 https://bugzilla.suse.com/1060904 SUSE Bug 1060904 https://bugzilla.suse.com/1061461 SUSE Bug 1061461 https://bugzilla.suse.com/1063014 SUSE Bug 1063014 https://bugzilla.suse.com/1066182 SUSE Bug 1066182 https://bugzilla.suse.com/1066502 SUSE Bug 1066502 https://bugzilla.suse.com/1067088 SUSE Bug 1067088 https://bugzilla.suse.com/1067119 SUSE Bug 1067119 https://bugzilla.suse.com/1067705 SUSE Bug 1067705 https://bugzilla.suse.com/1070357 SUSE Bug 1070357 https://bugzilla.suse.com/1071386 SUSE Bug 1071386 https://bugzilla.suse.com/1074301 SUSE Bug 1074301 https://bugzilla.suse.com/1079076 SUSE Bug 1079076 https://bugzilla.suse.com/1080788 SUSE Bug 1080788 https://bugzilla.suse.com/1081379 SUSE Bug 1081379 https://bugzilla.suse.com/1081600 SUSE Bug 1081600 https://bugzilla.suse.com/1086340 SUSE Bug 1086340 https://bugzilla.suse.com/1087269 SUSE Bug 1087269 https://bugzilla.suse.com/1087493 SUSE Bug 1087493 https://www.suse.com/security/cve/CVE-2017-16818/ SUSE CVE CVE-2017-16818 page https://www.suse.com/security/cve/CVE-2018-7262/ SUSE CVE CVE-2018-7262 page SUSE Linux Enterprise Desktop 12 SP3 SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Server for SAP Applications 12 SP3 SUSE Linux Enterprise Software Development Kit 12 SP3 ceph-common-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 libcephfs2-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 librados2-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 libradosstriper1-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 librbd1-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 librgw2-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 python-cephfs-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 python-rados-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 python-rbd-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 python-rgw-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 libcephfs-devel-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 librados-devel-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 librbd-devel-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 ceph-common-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 libcephfs2-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 librados2-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 libradosstriper1-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 librbd1-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 librgw2-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 python-cephfs-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 python-rados-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 python-rbd-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 python-rgw-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 ceph-common-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 as a component of SUSE Linux Enterprise Server 12 SP3 libcephfs2-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 as a component of SUSE Linux Enterprise Server 12 SP3 librados2-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 as a component of SUSE Linux Enterprise Server 12 SP3 libradosstriper1-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 as a component of SUSE Linux Enterprise Server 12 SP3 librbd1-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 as a component of SUSE Linux Enterprise Server 12 SP3 librgw2-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 as a component of SUSE Linux Enterprise Server 12 SP3 python-cephfs-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 as a component of SUSE Linux Enterprise Server 12 SP3 python-rados-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 as a component of SUSE Linux Enterprise Server 12 SP3 python-rbd-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 as a component of SUSE Linux Enterprise Server 12 SP3 python-rgw-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 as a component of SUSE Linux Enterprise Server 12 SP3 ceph-common-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 libcephfs2-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 librados2-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 libradosstriper1-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 librbd1-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 librgw2-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 python-cephfs-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 python-rados-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 python-rbd-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 python-rgw-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 libcephfs-devel-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 librados-devel-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 librbd-devel-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 RADOS Gateway in Ceph 12.1.0 through 12.2.1 allows remote authenticated users to cause a denial of service (assertion failure and application exit) by leveraging "full" (not necessarily admin) privileges to post an invalid profile to the admin API, related to rgw/rgw_iam_policy.cc, rgw/rgw_basic_types.h, and rgw/rgw_iam_types.h. CVE-2017-16818 SUSE Linux Enterprise Desktop 12 SP3:ceph-common-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Desktop 12 SP3:libcephfs2-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Desktop 12 SP3:librados2-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Desktop 12 SP3:libradosstriper1-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Desktop 12 SP3:librbd1-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Desktop 12 SP3:librgw2-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Desktop 12 SP3:python-cephfs-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Desktop 12 SP3:python-rados-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Desktop 12 SP3:python-rbd-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Desktop 12 SP3:python-rgw-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Server 12 SP3:ceph-common-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Server 12 SP3:libcephfs2-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Server 12 SP3:librados2-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Server 12 SP3:libradosstriper1-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Server 12 SP3:librbd1-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Server 12 SP3:librgw2-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Server 12 SP3:python-cephfs-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Server 12 SP3:python-rados-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Server 12 SP3:python-rbd-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Server 12 SP3:python-rgw-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:ceph-common-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libcephfs2-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:librados2-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libradosstriper1-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:librbd1-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:librgw2-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:python-cephfs-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:python-rados-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:python-rbd-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:python-rgw-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Software Development Kit 12 SP3:libcephfs-devel-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Software Development Kit 12 SP3:librados-devel-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Software Development Kit 12 SP3:librbd-devel-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 important 6.8 AV:N/AC:L/Au:S/C:N/I:N/A:C 4 AV:N/AC:L/Au:S/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20181417-1/ https://www.suse.com/security/cve/CVE-2017-16818.html CVE-2017-16818 https://bugzilla.suse.com/1063014 SUSE Bug 1063014 https://bugzilla.suse.com/1069253 SUSE Bug 1069253 In Ceph before 12.2.3 and 13.x through 13.0.1, the rgw_civetweb.cc RGWCivetWeb::init_env function in radosgw doesn't handle malformed HTTP headers properly, allowing for denial of service. CVE-2018-7262 SUSE Linux Enterprise Desktop 12 SP3:ceph-common-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Desktop 12 SP3:libcephfs2-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Desktop 12 SP3:librados2-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Desktop 12 SP3:libradosstriper1-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Desktop 12 SP3:librbd1-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Desktop 12 SP3:librgw2-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Desktop 12 SP3:python-cephfs-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Desktop 12 SP3:python-rados-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Desktop 12 SP3:python-rbd-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Desktop 12 SP3:python-rgw-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Server 12 SP3:ceph-common-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Server 12 SP3:libcephfs2-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Server 12 SP3:librados2-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Server 12 SP3:libradosstriper1-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Server 12 SP3:librbd1-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Server 12 SP3:librgw2-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Server 12 SP3:python-cephfs-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Server 12 SP3:python-rados-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Server 12 SP3:python-rbd-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Server 12 SP3:python-rgw-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:ceph-common-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libcephfs2-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:librados2-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libradosstriper1-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:librbd1-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:librgw2-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:python-cephfs-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:python-rados-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:python-rbd-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:python-rgw-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Software Development Kit 12 SP3:libcephfs-devel-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Software Development Kit 12 SP3:librados-devel-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 SUSE Linux Enterprise Software Development Kit 12 SP3:librbd-devel-12.2.5+git.1524775272.5e7ea8cf03-2.7.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20181417-1/ https://www.suse.com/security/cve/CVE-2018-7262.html CVE-2018-7262 https://bugzilla.suse.com/1081379 SUSE Bug 1081379