Security update for ceph SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:2193-1 Final 1 1 2018-08-03T17:46:09Z current 2018-08-03T17:46:09Z 2018-08-03T17:46:09Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for ceph This update for ceph fixes the following issues: - Update to version 12.2.7-420-gc0ef85b854: * https://ceph.com/releases/12-2-7-luminous-released/ * luminous: osd: eternal stuck PG in 'unfound_recovery' (bsc#1094932) * bluestore: db.slow used when db is not full (bsc#1092874) * CVE-2018-10861: Ensure that ceph-mon does perform authorization on all OSD pool ops (bsc#1099162). * CVE-2018-1129: cephx signature check bypass (bsc#1096748). * CVE-2018-1128: cephx protocol was vulnerable to replay attack (bsc#1096748). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-DESKTOP-12-SP3-2018-1494,SUSE-SLE-SDK-12-SP3-2018-1494,SUSE-SLE-SERVER-12-SP3-2018-1494 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20182193-1/ Link for SUSE-SU-2018:2193-1 https://www.suse.com/support/update/announcement/2018/suse-su-20182193-1.html E-Mail link for SUSE-SU-2018:2193-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1092874 SUSE Bug 1092874 https://bugzilla.suse.com/1094932 SUSE Bug 1094932 https://bugzilla.suse.com/1096748 SUSE Bug 1096748 https://bugzilla.suse.com/1099162 SUSE Bug 1099162 https://www.suse.com/security/cve/CVE-2018-10861/ SUSE CVE CVE-2018-10861 page https://www.suse.com/security/cve/CVE-2018-1128/ SUSE CVE CVE-2018-1128 page https://www.suse.com/security/cve/CVE-2018-1129/ SUSE CVE CVE-2018-1129 page SUSE Linux Enterprise Desktop 12 SP3 SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Server for SAP Applications 12 SP3 SUSE Linux Enterprise Software Development Kit 12 SP3 ceph-common-12.2.7+git.1531910353.c0ef85b854-2.12.1 libcephfs2-12.2.7+git.1531910353.c0ef85b854-2.12.1 librados2-12.2.7+git.1531910353.c0ef85b854-2.12.1 libradosstriper1-12.2.7+git.1531910353.c0ef85b854-2.12.1 librbd1-12.2.7+git.1531910353.c0ef85b854-2.12.1 librgw2-12.2.7+git.1531910353.c0ef85b854-2.12.1 python-cephfs-12.2.7+git.1531910353.c0ef85b854-2.12.1 python-rados-12.2.7+git.1531910353.c0ef85b854-2.12.1 python-rbd-12.2.7+git.1531910353.c0ef85b854-2.12.1 python-rgw-12.2.7+git.1531910353.c0ef85b854-2.12.1 libcephfs-devel-12.2.7+git.1531910353.c0ef85b854-2.12.1 librados-devel-12.2.7+git.1531910353.c0ef85b854-2.12.1 librbd-devel-12.2.7+git.1531910353.c0ef85b854-2.12.1 ceph-common-12.2.7+git.1531910353.c0ef85b854-2.12.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 libcephfs2-12.2.7+git.1531910353.c0ef85b854-2.12.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 librados2-12.2.7+git.1531910353.c0ef85b854-2.12.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 libradosstriper1-12.2.7+git.1531910353.c0ef85b854-2.12.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 librbd1-12.2.7+git.1531910353.c0ef85b854-2.12.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 librgw2-12.2.7+git.1531910353.c0ef85b854-2.12.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 python-cephfs-12.2.7+git.1531910353.c0ef85b854-2.12.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 python-rados-12.2.7+git.1531910353.c0ef85b854-2.12.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 python-rbd-12.2.7+git.1531910353.c0ef85b854-2.12.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 python-rgw-12.2.7+git.1531910353.c0ef85b854-2.12.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 ceph-common-12.2.7+git.1531910353.c0ef85b854-2.12.1 as a component of SUSE Linux Enterprise Server 12 SP3 libcephfs2-12.2.7+git.1531910353.c0ef85b854-2.12.1 as a component of SUSE Linux Enterprise Server 12 SP3 librados2-12.2.7+git.1531910353.c0ef85b854-2.12.1 as a component of SUSE Linux Enterprise Server 12 SP3 libradosstriper1-12.2.7+git.1531910353.c0ef85b854-2.12.1 as a component of SUSE Linux Enterprise Server 12 SP3 librbd1-12.2.7+git.1531910353.c0ef85b854-2.12.1 as a component of SUSE Linux Enterprise Server 12 SP3 librgw2-12.2.7+git.1531910353.c0ef85b854-2.12.1 as a component of SUSE Linux Enterprise Server 12 SP3 python-cephfs-12.2.7+git.1531910353.c0ef85b854-2.12.1 as a component of SUSE Linux Enterprise Server 12 SP3 python-rados-12.2.7+git.1531910353.c0ef85b854-2.12.1 as a component of SUSE Linux Enterprise Server 12 SP3 python-rbd-12.2.7+git.1531910353.c0ef85b854-2.12.1 as a component of SUSE Linux Enterprise Server 12 SP3 python-rgw-12.2.7+git.1531910353.c0ef85b854-2.12.1 as a component of SUSE Linux Enterprise Server 12 SP3 ceph-common-12.2.7+git.1531910353.c0ef85b854-2.12.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 libcephfs2-12.2.7+git.1531910353.c0ef85b854-2.12.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 librados2-12.2.7+git.1531910353.c0ef85b854-2.12.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 libradosstriper1-12.2.7+git.1531910353.c0ef85b854-2.12.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 librbd1-12.2.7+git.1531910353.c0ef85b854-2.12.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 librgw2-12.2.7+git.1531910353.c0ef85b854-2.12.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 python-cephfs-12.2.7+git.1531910353.c0ef85b854-2.12.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 python-rados-12.2.7+git.1531910353.c0ef85b854-2.12.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 python-rbd-12.2.7+git.1531910353.c0ef85b854-2.12.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 python-rgw-12.2.7+git.1531910353.c0ef85b854-2.12.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 libcephfs-devel-12.2.7+git.1531910353.c0ef85b854-2.12.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 librados-devel-12.2.7+git.1531910353.c0ef85b854-2.12.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 librbd-devel-12.2.7+git.1531910353.c0ef85b854-2.12.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph storage pools and corrupt snapshot images. Ceph branches master, mimic, luminous and jewel are believed to be affected. CVE-2018-10861 SUSE Linux Enterprise Desktop 12 SP3:ceph-common-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Desktop 12 SP3:libcephfs2-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Desktop 12 SP3:librados2-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Desktop 12 SP3:libradosstriper1-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Desktop 12 SP3:librbd1-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Desktop 12 SP3:librgw2-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Desktop 12 SP3:python-cephfs-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Desktop 12 SP3:python-rados-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Desktop 12 SP3:python-rbd-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Desktop 12 SP3:python-rgw-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server 12 SP3:ceph-common-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server 12 SP3:libcephfs2-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server 12 SP3:librados2-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server 12 SP3:libradosstriper1-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server 12 SP3:librbd1-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server 12 SP3:librgw2-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server 12 SP3:python-cephfs-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server 12 SP3:python-rados-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server 12 SP3:python-rbd-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server 12 SP3:python-rgw-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:ceph-common-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libcephfs2-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:librados2-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libradosstriper1-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:librbd1-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:librgw2-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:python-cephfs-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:python-rados-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:python-rbd-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:python-rgw-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Software Development Kit 12 SP3:libcephfs-devel-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Software Development Kit 12 SP3:librados-devel-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Software Development Kit 12 SP3:librbd-devel-12.2.7+git.1531910353.c0ef85b854-2.12.1 important 5.5 AV:N/AC:L/Au:S/C:N/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20182193-1/ https://www.suse.com/security/cve/CVE-2018-10861.html CVE-2018-10861 https://bugzilla.suse.com/1099162 SUSE Bug 1099162 https://bugzilla.suse.com/1114710 SUSE Bug 1114710 It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to ceph cluster network who is able to sniff packets on network can use this vulnerability to authenticate with ceph service and perform actions allowed by ceph service. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable. CVE-2018-1128 SUSE Linux Enterprise Desktop 12 SP3:ceph-common-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Desktop 12 SP3:libcephfs2-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Desktop 12 SP3:librados2-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Desktop 12 SP3:libradosstriper1-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Desktop 12 SP3:librbd1-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Desktop 12 SP3:librgw2-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Desktop 12 SP3:python-cephfs-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Desktop 12 SP3:python-rados-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Desktop 12 SP3:python-rbd-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Desktop 12 SP3:python-rgw-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server 12 SP3:ceph-common-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server 12 SP3:libcephfs2-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server 12 SP3:librados2-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server 12 SP3:libradosstriper1-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server 12 SP3:librbd1-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server 12 SP3:librgw2-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server 12 SP3:python-cephfs-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server 12 SP3:python-rados-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server 12 SP3:python-rbd-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server 12 SP3:python-rgw-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:ceph-common-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libcephfs2-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:librados2-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libradosstriper1-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:librbd1-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:librgw2-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:python-cephfs-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:python-rados-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:python-rbd-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:python-rgw-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Software Development Kit 12 SP3:libcephfs-devel-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Software Development Kit 12 SP3:librados-devel-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Software Development Kit 12 SP3:librbd-devel-12.2.7+git.1531910353.c0ef85b854-2.12.1 important 5.4 AV:A/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20182193-1/ https://www.suse.com/security/cve/CVE-2018-1128.html CVE-2018-1128 https://bugzilla.suse.com/1096748 SUSE Bug 1096748 https://bugzilla.suse.com/1114710 SUSE Bug 1114710 https://bugzilla.suse.com/1177843 SUSE Bug 1177843 https://bugzilla.suse.com/1177859 SUSE Bug 1177859 A flaw was found in the way signature calculation was handled by cephx authentication protocol. An attacker having access to ceph cluster network who is able to alter the message payload was able to bypass signature checks done by cephx protocol. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable. CVE-2018-1129 SUSE Linux Enterprise Desktop 12 SP3:ceph-common-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Desktop 12 SP3:libcephfs2-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Desktop 12 SP3:librados2-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Desktop 12 SP3:libradosstriper1-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Desktop 12 SP3:librbd1-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Desktop 12 SP3:librgw2-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Desktop 12 SP3:python-cephfs-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Desktop 12 SP3:python-rados-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Desktop 12 SP3:python-rbd-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Desktop 12 SP3:python-rgw-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server 12 SP3:ceph-common-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server 12 SP3:libcephfs2-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server 12 SP3:librados2-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server 12 SP3:libradosstriper1-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server 12 SP3:librbd1-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server 12 SP3:librgw2-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server 12 SP3:python-cephfs-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server 12 SP3:python-rados-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server 12 SP3:python-rbd-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server 12 SP3:python-rgw-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:ceph-common-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libcephfs2-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:librados2-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libradosstriper1-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:librbd1-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:librgw2-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:python-cephfs-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:python-rados-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:python-rbd-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:python-rgw-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Software Development Kit 12 SP3:libcephfs-devel-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Software Development Kit 12 SP3:librados-devel-12.2.7+git.1531910353.c0ef85b854-2.12.1 SUSE Linux Enterprise Software Development Kit 12 SP3:librbd-devel-12.2.7+git.1531910353.c0ef85b854-2.12.1 important 3.3 AV:A/AC:L/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20182193-1/ https://www.suse.com/security/cve/CVE-2018-1129.html CVE-2018-1129 https://bugzilla.suse.com/1096748 SUSE Bug 1096748 https://bugzilla.suse.com/1114710 SUSE Bug 1114710