RHSA-2016:2815 - Security Advisory

Topic

An update is now available for Red Hat Ceph Storage 2.1 that fix one security issue, multiple bugs, and add various enhancements. This erratum is applicable for Red Hat Ceph Storage that runs on RHEL 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable version of the Ceph storage system with a Ceph management platform, deployment utilities, and support services.

The following packages have been upgraded to a newer upstream version: ceph (10.2.3), ceph-deploy (1.5.36), calamari-server (1.4.9), nfs-ganesha (2.4.0), ceph-iscsi-config (1.5), libntirpc (1.4.1), ceph-iscsi-tools (1.1). (BZ#1340004, BZ#1349999)

Security Fix(es):

• A flaw was found in the way Ceph Object Gateway handles POST object requests. An authenticated attacker could launch a denial of service attack by sending null or specially crafted POST object requests. (CVE-2016-8626)

Bug Fix(es) and Enhancement(s):

For detailed information on changes in this release, see the Red Hat Ceph
Storage 2.1 Release Notes available at:

https://access.redhat.com/documentation/en/red-hat-ceph-storage/2.1/single/release-notes/

All users of Red Hat Ceph Storage are advised to upgrade to these updated
packages.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Ceph Storage MON 2 x86_64
• Red Hat Ceph Storage OSD 2 x86_64

Fixes

• BZ - 1241725 - No or not correct input validation in "ceph" cli
• BZ - 1265792 - [RFE] Static website hosting
• BZ - 1300855 - [RFE] Support for PKIZ and other token formats with Keystone integration
• BZ - 1314582 - RGW: S3 request-payer
• BZ - 1314584 - RGW: indexless buckets
• BZ - 1318409 - RGW deletion is sequential and slow on large buckets of objects
• BZ - 1326740 - ceph-disk@dev-sd<>2.service is created on all OSD nodes, and its in failed state
• BZ - 1331770 - reweight-by-utilization accepts 0 and -ve values for 'max_change_osds'
• BZ - 1332513 - [RFE] rados bench : add cleanup message with time it has taken to delete the objects when cleanup start for written objects
• BZ - 1333398 - [RH Ceph 2] Do a proper SELinux relabel on rhel 7.3+
• BZ - 1339256 - [RFE] rgw : support size suffixes for --max-size in radosgw-admin command
• BZ - 1340004 - Seeing lots of "heartbeat_map" messages when stopping an MDS Server
• BZ - 1340772 - Seeing Error Message "librbd::SnapshotRenameRequest: encountered error: (17) File exists"
• BZ - 1346946 - Seeing Error message in rbd_mirror status on Master Node
• BZ - 1347137 - Calamari cli endpoint api returns errors for rados df
• BZ - 1347174 - Object Map and Fast Diff Flag is getting invalid, while doing multiple times enable/disable of Journaling on an Image
• BZ - 1347205 - Even after disabling Journal, the image is showing up in Slave Node
• BZ - 1347664 - Seeing a continuous error messge "librbd::ObjectWatcher: rbd_mirroring: handle_rewatch: error encountered during re-watch: (108) Cannot send after transport endpoint shutdown"
• BZ - 1348928 - Seeing a Crash at "librbd/operation/Request.cc: 92: FAILED assert(m_op_tid != 0)", while creating snapshot on Slave Node
• BZ - 1348940 - Restart of RBD daemon is again initiating full Sync/Copy of an Image
• BZ - 1349116 - RBD with object-map enabled results in poor performance with discard
• BZ - 1349332 - Clone creation is successful in Slave Node
• BZ - 1349955 - After demotion/promotion, the image is again syncing from the beginning
• BZ - 1349999 - [RH Ceph 2.0]: ceph-deploy handle package split for ceph-mon and ceph-osd
• BZ - 1350522 - S3 object versioning fails when applied on a non-master zone
• BZ - 1351484 - ceph-disk should timeout when a lock cannot be acquired
• BZ - 1352888 - [Upgrade]: on Ceph upgrade from 1.3.2 to 2.0 the RGW default zone setup is not working
• BZ - 1354459 - 2.0: rbd commands via API: few commands hang when used from browser
• BZ - 1356931 - Hitting a Crash while deleting the Mirrored Images from Master Node
• BZ - 1358024 - non-contiguous rgw_write/NFS WRITE operations no blocked
• BZ - 1359712 - A master zone switch requires radosgw to be restarted
• BZ - 1360849 - ceph-fuse fails to mount when entry exists in /etc/fstab
• BZ - 1364352 - Add zone rename to radosgw-admin(8)
• BZ - 1364353 - Increase log level for some of the messages that occur in rgw admin command.
• BZ - 1365648 - [rbd-mirror] - Unable to write data on the promoted image from secondary rbd host
• BZ - 1367182 - [RFE] Ansible iSCSI userland
• BZ - 1367442 - [RHCS-2.0] ceph-objectstore-tool: ability to perform filestore splits offline : new command apply-layout-settings
• BZ - 1372346 - RGW underscore issue redux
• BZ - 1374224 - [RFE] RHCS-2 add a tool to rebuild mon store from OSD
• BZ - 1377774 - Potential non-null terminated block name prefix string from API
• BZ - 1378675 - Assign LOG_INFO priority to syslog calls
• BZ - 1379835 - [RFE] [rbd-mirror] - optionally unregister "laggy" journal clients
• BZ - 1380601 - [RFE] [rhcs-2.y] RGW resharding tool
• BZ - 1381687 - RFE: rgw ldap does not support custom ldap search filters
• BZ - 1381692 - rgw_lookup can not exact match file name
• BZ - 1381694 - rgw ldap: unhandled exception on invalid token input
• BZ - 1382044 - Cannot disable journaling or remove non-mirrored, "non-primary" image
• BZ - 1383631 - Old radosgw-admin corrupt radosgw configuration for an upgrade radosgw
• BZ - 1383728 - [RHCS 2] RGW goes into loop causing 100% CPU utilization
• BZ - 1384002 - mon crash when MDSs run with standby_for_rank set
• BZ - 1384008 - ceph-fuse crashes intermittently when quotas are in use
• BZ - 1384230 - iSCSI performance is slow on secondary (non-optimised) paths during failover
• BZ - 1384748 - iSCSI failover time is too long when a gateway is shutdown
• BZ - 1385729 - nfs-ganesha 2.4.0 and libntirpc 1.4.1
• BZ - 1386910 - ceph-iscsi-config should make an ALUA group per iSCSI tpg created
• BZ - 1386939 - [ceph-iscsi-config] should allow lun definitions to be fqdn names as well as shortnames
• BZ - 1387332 - [rhcs-2.y] rgw: crash when client post object with null conditions
• BZ - 1389193 - CVE-2016-8626 Ceph: RGW Denial of Service by sending null or specially crafted POST object requests
• BZ - 1393665 - Multisite error handling leads to segfaults

CVEs

• CVE-2016-8626

References

• https://access.redhat.com/security/updates/classification/#moderate