Synopsis

Moderate: Red Hat Ceph Storage 3.0 security and bug fix update

Type/Severity

Security Advisory: Moderate

Topic

An update for ceph is now available for Red Hat Ceph Storage 3.0 for Red
Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat Ceph Storage is a scalable, open, software-defined storage platform
that combines the most stable version of the Ceph storage system with a
Ceph management platform, deployment utilities, and support services.

Security Fix(es):

• ceph: cephx protocol is vulnerable to replay attack (CVE-2018-1128)
  
• ceph: cephx uses weak signatures (CVE-2018-1129)
  
• ceph: ceph-mon does not perform authorization on OSD pool ops (CVE-2018-10861)
  

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Previously, Ceph RADOS Gateway (RGW) instances in zones configured for multi-site replication would crash if configured to disable sync ("rgw_run_sync_thread = false"). Therefor, multi-site replication environments could not start dedicated non-replication RGW instances. With this update, the "rgw_run_sync_thread" option can be used to configure RGW instances that will not participate in replication even if their zone is replicated. (BZ#1552202)
  
• Previously, when increasing "max_mds" from "1" to "2", if the Metadata Server (MDS) daemon was in the starting/resolve state for a long period of time, then restarting the MDS daemon lead to assert. This caused the Ceph File System (CephFS) to be in degraded state. With this update, increasing "max_mds" no longer causes CephFS to be in degraded state. (BZ#1566016)
  
• Previously, the transition to containerized Ceph left some "ceph-disk" unit files. The files were harmless, but appeared as failing. With this update, executing the "switch-from-non-containerized-to-containerized-ceph-daemons.yml" playbook disables the "ceph-disk" unit files too. (BZ#1577846)
  
• Previously, the "entries_behind_master" metric output from the "rbd mirror image status" CLI tool did not always reduce to zero under synthetic workloads. This could cause a false alarm that there is an issue with RBD mirroring replications. With this update, the metric is now updated periodically without the need for an explicit I/O flush in the workload. (BZ#1578509)
  
• Previously, when using the "pool create" command with "expected_num_objects", placement group (PG) directories were not pre-created at pool creation time as expected, resulting in performance drops when filestore splitting occurred. With this update, the "expected_num_objects" parameter is now passed through to filestore correctly, and PG directories for the expected number of objects are pre-created at pool creation time. (BZ#1579039)
  
• Previously, internal RADOS Gateway (RGW) multi-site sync logic behaved incorrectly when attempting to sync containers with S3 object versioning enabled. Objects in versioning-enabled containers would fail to sync in some scenarios—for example, when using "s3cmd sync" to mirror a filesystem directory. With this update, RGW multi-site replication logic has been corrected for the known failure cases. (BZ#1580497)
  
• When restarting OSD daemons, the "ceph-ansible" restart script goes through all the daemons by listing the units with systemctl list-units. Under certain circumstances, the output of the command contains extra spaces, which caused parsing and restart to fail. With this update, the underlying code has been changed to handle the extra space.
  
• Previously, the Ceph RADOS Gateway (RGW) server treated negative byte-range object requests ("bytes=0--1") as invalid. Applications that expect the AWS behavior for negative or other invalid range requests saw unexpected errors and could fail. With this update, a new option "rgw_ignore_get_invalid_range" has been added to RGW. When "rgw_ignore_get_invalid_range" is set to "true", the RGW behavior for invalid range requests is backwards compatible with AWS.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Ceph Storage 3 x86_64
• Red Hat Ceph Storage MON 3 x86_64
• Red Hat Ceph Storage OSD 3 x86_64

Fixes

• BZ - 1532645 - cephmetrics-collectd fails to start due to SELinux errors
• BZ - 1534657 - [cephmetrics] Installation of cephmetrics on ceph3.0 fails
• BZ - 1549004 - [Ceph-ansible] Failure on TASK [igw_purge | purging the gateway configuration]
• BZ - 1552202 - RGW multi-site segfault received when 'rgw_run_sync_thread = False' is set in ceph.conf
• BZ - 1552509 - Ubuntu ansible version should be same as RHEL ansible version
• BZ - 1566016 - [cephfs]: MDS asserted while in Starting/resolve state
• BZ - 1569694 - RGW: when using bucket request payer with boto3, NotImplemented error is seen.
• BZ - 1570597 - [CephFS]: MDS assert, ceph-12.2.1/src/mds/MDCache.cc: 5080: FAILED assert(isolated_inodes.empty())
• BZ - 1575024 - prevent ESTALE errors on clean shutdown in nfs-ganesha
• BZ - 1575866 - CVE-2018-1128 ceph: cephx protocol is vulnerable to replay attack
• BZ - 1576057 - CVE-2018-1129 ceph: cephx uses weak signatures
• BZ - 1576861 - CephFS mount ceph-fuse hang during unmount after eviction
• BZ - 1576908 - [CephFS]: Client IO's hung Fuse service asserted with error FAILED assert(oset.objects.empty()
• BZ - 1577846 - After latest environment update all ceph-disk@dev-sdXX.service are in failed state
• BZ - 1578509 - entries_behind_master metric output but "rbd mirror image status " never reduces to zero.
• BZ - 1578572 - [RFE] Ceph-Ansible main.yml places restart scripts in /tmp - causing failures running restart scripts
• BZ - 1579039 - Pool create cmd's expected_num_objects is not properly interpreted
• BZ - 1581403 - OSDs are restarted twice during rolling update
• BZ - 1581573 - ceph-radosgw: disable NSS PKI db when SSL is disabled
• BZ - 1585748 - objects in cache never refresh after rgw_cache_expiry_interval
• BZ - 1593308 - CVE-2018-10861 ceph: ceph-mon does not perform authorization on OSD pool ops
• BZ - 1594974 - [ceph-ansible 3.0.33-2redhat1] mgr repo not setup with ceph-ansible when using rhcs downstream settings
• BZ - 1598185 - [ceph-ansible] - RHEL and Ubuntu CDN based installation failing trying to enable/include mon repository

CVEs

• CVE-2018-1128
• CVE-2018-1129
• CVE-2018-10861

References

• https://access.redhat.com/security/updates/classification/#moderate

Red Hat Ceph Storage 3

SRPM
ceph-12.2.4-30.el7cp.src.rpm	SHA-256: 611b9e33fe39c5b18e7d13cbf90223b04db7d1080a23928ece65b1bb699ff512
ceph-ansible-3.0.39-1.el7cp.src.rpm	SHA-256: c5730aa31a37120cb96e603ef9acb545d1905cb0594ed8ac2e608c43a2107d27
cephmetrics-1.0.1-1.el7cp.src.rpm	SHA-256: e3a789d1a267f95180722d75a4a3ce1b3b03b44317c231499cc78783ce3bdc00
nfs-ganesha-2.5.5-6.el7cp.src.rpm	SHA-256: 70dd3f22ae9c91dc6b8a822257b6f27475613476ff9e5191722f92388675d13f
x86_64
ceph-ansible-3.0.39-1.el7cp.noarch.rpm	SHA-256: fd36c551ac23403f8c4c34a62cd155cacf23c38dded3cef281e76feecb27c5d0
ceph-base-12.2.4-30.el7cp.x86_64.rpm	SHA-256: ea6de0e8d665fefd37430b49c1ee62508f80aeea911b52618788881b79455773
ceph-common-12.2.4-30.el7cp.x86_64.rpm	SHA-256: dc561f1db96dc42c5c4221da59c6a9df8ed0b8f709da6dd9eff6aef20a902042
ceph-debuginfo-12.2.4-30.el7cp.x86_64.rpm	SHA-256: 8e482136de956a90099c6326d21d5551e61eb2c264deacc3a18e71839d58a37f
ceph-fuse-12.2.4-30.el7cp.x86_64.rpm	SHA-256: 52a7f5bb821622cde9dd18f92afdc701e83599b7260a4a09b33777433a5facfa
ceph-mds-12.2.4-30.el7cp.x86_64.rpm	SHA-256: 217560d1434df8c2802288e1fd8349505d9b2ca7f4bcac475f4825a50ac9fbfa
ceph-radosgw-12.2.4-30.el7cp.x86_64.rpm	SHA-256: 21fe46c9dffba4668c8956f4b6e0fc441b0a936b0ab1efe8f3eb17edea59a1fc
ceph-selinux-12.2.4-30.el7cp.x86_64.rpm	SHA-256: 13a7e75fc0a02e42a74251755a3183f743bb290c6b8b73ed25cb5bff6246ff28
cephmetrics-1.0.1-1.el7cp.x86_64.rpm	SHA-256: 64462b8f1470d2a5fe216ac8cd48ca1fbd49ca78371af723311edb7668f66ad4
cephmetrics-ansible-1.0.1-1.el7cp.x86_64.rpm	SHA-256: 138c4e3b7d87533f501a5d8588940e9692607a4aaea402ea5c94407f2892446f
cephmetrics-collectors-1.0.1-1.el7cp.x86_64.rpm	SHA-256: 003b9a105145722c88eec833c486f43d74f1ff55801ee28a39e26d703a617496
cephmetrics-grafana-plugins-1.0.1-1.el7cp.x86_64.rpm	SHA-256: 7efe2c73050a78ae857acf1caa5ea897557f1455d63ee8961e90d519edf7f041
libcephfs-devel-12.2.4-30.el7cp.x86_64.rpm	SHA-256: 7e8690e0b505603c4e7850ace8a6269f7636331a65c6f9431aad39f549acf82f
libcephfs2-12.2.4-30.el7cp.x86_64.rpm	SHA-256: 91ce5f5d60565b9d024ddfb4f6696f061d6b708949d65b733de3c09a41248151
librados-devel-12.2.4-30.el7cp.x86_64.rpm	SHA-256: 2b6e6282f24376641ec1cbfa8af0bb2a00770a7e113dc732143917d26be09668
librados2-12.2.4-30.el7cp.x86_64.rpm	SHA-256: dd8829ca9d3c7f37d1b341fe610b04e7fa70e93e738e61909481927648f8bb6d
libradosstriper1-12.2.4-30.el7cp.x86_64.rpm	SHA-256: 691c6e1078d04983a1e8970f2bb97d9ba91a936ac7dd489fa3fc16bc386f1992
librbd-devel-12.2.4-30.el7cp.x86_64.rpm	SHA-256: 9374cffa02877d50af3b6785ad502fd5aab1072e3a83693f7f2a92d8452daead
librbd1-12.2.4-30.el7cp.x86_64.rpm	SHA-256: a93851db92dfc4197674e494c062bed38051936c04dfb215d7889d58de9b847e
librgw-devel-12.2.4-30.el7cp.x86_64.rpm	SHA-256: bbc164ee63aadb08bf787bbd05a7f885c84a215e816a684efa4939a5ed82c24a
librgw2-12.2.4-30.el7cp.x86_64.rpm	SHA-256: 76c07d0fc5de27fe2d4b906036c3ff56f6b74eecea9831f1680bd67e7a4a21cd
nfs-ganesha-2.5.5-6.el7cp.x86_64.rpm	SHA-256: c322bf40ef7bd7faece23f43f89ad4288c560d77bdfb1245de918b9b6d3d9e9f
nfs-ganesha-ceph-2.5.5-6.el7cp.x86_64.rpm	SHA-256: 99acb40b602e57f34e42a6742d7faff40337cc95cc4eeaae53275f5c373bddd3
nfs-ganesha-debuginfo-2.5.5-6.el7cp.x86_64.rpm	SHA-256: 9d2f0967faaa9ad7d4f8a602fac9767a3f017684ccd6c1b58d98fa2636c84580
nfs-ganesha-rgw-2.5.5-6.el7cp.x86_64.rpm	SHA-256: 56ee6ee422c131b61db340c506382b3a7f485c5c99be195afe1861c4ec93d2ef
python-cephfs-12.2.4-30.el7cp.x86_64.rpm	SHA-256: d78ae7ff049d1d8fe08aa1ce25e111f3b85d1e646928235271fc169a52814f00
python-rados-12.2.4-30.el7cp.x86_64.rpm	SHA-256: 32ce0d8cb6cf8d0c60e4c6c4608fc14d497221593f6427c763b110aea8b66911
python-rbd-12.2.4-30.el7cp.x86_64.rpm	SHA-256: 38d7842386b3057df619d8b871c7a5470c521eb04582f71d01f24f4b48940c46
python-rgw-12.2.4-30.el7cp.x86_64.rpm	SHA-256: af5ef9e97fa8869c015e992069ecf4ae57e968dd853aca7c35fc63e7a96dd5a1
rbd-mirror-12.2.4-30.el7cp.x86_64.rpm	SHA-256: d631f72c38eb8dd5775b7c710e243744fe8f294d5b09f0bfcfb30b740a5797f6

Red Hat Ceph Storage MON 3

SRPM
ceph-12.2.4-30.el7cp.src.rpm	SHA-256: 611b9e33fe39c5b18e7d13cbf90223b04db7d1080a23928ece65b1bb699ff512
cephmetrics-1.0.1-1.el7cp.src.rpm	SHA-256: e3a789d1a267f95180722d75a4a3ce1b3b03b44317c231499cc78783ce3bdc00
x86_64
ceph-base-12.2.4-30.el7cp.x86_64.rpm	SHA-256: ea6de0e8d665fefd37430b49c1ee62508f80aeea911b52618788881b79455773
ceph-common-12.2.4-30.el7cp.x86_64.rpm	SHA-256: dc561f1db96dc42c5c4221da59c6a9df8ed0b8f709da6dd9eff6aef20a902042
ceph-debuginfo-12.2.4-30.el7cp.x86_64.rpm	SHA-256: 8e482136de956a90099c6326d21d5551e61eb2c264deacc3a18e71839d58a37f
ceph-mgr-12.2.4-30.el7cp.x86_64.rpm	SHA-256: d525522114daa407a242724bffe2d5c83c24f55fee485e2b2cba121334d916a8
ceph-mon-12.2.4-30.el7cp.x86_64.rpm	SHA-256: e9bd2308eb091297fb6c927f6b33c3727c4397f8ad5f266e402d604bfe589709
ceph-selinux-12.2.4-30.el7cp.x86_64.rpm	SHA-256: 13a7e75fc0a02e42a74251755a3183f743bb290c6b8b73ed25cb5bff6246ff28
ceph-test-12.2.4-30.el7cp.x86_64.rpm	SHA-256: cf38941e51c54e6a2cecb25c7be0ea250ca55353261b4fe699ed692f82bd0d91
cephmetrics-collectors-1.0.1-1.el7cp.x86_64.rpm	SHA-256: 003b9a105145722c88eec833c486f43d74f1ff55801ee28a39e26d703a617496
libcephfs-devel-12.2.4-30.el7cp.x86_64.rpm	SHA-256: 7e8690e0b505603c4e7850ace8a6269f7636331a65c6f9431aad39f549acf82f
libcephfs2-12.2.4-30.el7cp.x86_64.rpm	SHA-256: 91ce5f5d60565b9d024ddfb4f6696f061d6b708949d65b733de3c09a41248151
librados-devel-12.2.4-30.el7cp.x86_64.rpm	SHA-256: 2b6e6282f24376641ec1cbfa8af0bb2a00770a7e113dc732143917d26be09668
librados2-12.2.4-30.el7cp.x86_64.rpm	SHA-256: dd8829ca9d3c7f37d1b341fe610b04e7fa70e93e738e61909481927648f8bb6d
libradosstriper1-12.2.4-30.el7cp.x86_64.rpm	SHA-256: 691c6e1078d04983a1e8970f2bb97d9ba91a936ac7dd489fa3fc16bc386f1992
librbd-devel-12.2.4-30.el7cp.x86_64.rpm	SHA-256: 9374cffa02877d50af3b6785ad502fd5aab1072e3a83693f7f2a92d8452daead
librbd1-12.2.4-30.el7cp.x86_64.rpm	SHA-256: a93851db92dfc4197674e494c062bed38051936c04dfb215d7889d58de9b847e
librgw-devel-12.2.4-30.el7cp.x86_64.rpm	SHA-256: bbc164ee63aadb08bf787bbd05a7f885c84a215e816a684efa4939a5ed82c24a
librgw2-12.2.4-30.el7cp.x86_64.rpm	SHA-256: 76c07d0fc5de27fe2d4b906036c3ff56f6b74eecea9831f1680bd67e7a4a21cd
python-cephfs-12.2.4-30.el7cp.x86_64.rpm	SHA-256: d78ae7ff049d1d8fe08aa1ce25e111f3b85d1e646928235271fc169a52814f00
python-rados-12.2.4-30.el7cp.x86_64.rpm	SHA-256: 32ce0d8cb6cf8d0c60e4c6c4608fc14d497221593f6427c763b110aea8b66911
python-rbd-12.2.4-30.el7cp.x86_64.rpm	SHA-256: 38d7842386b3057df619d8b871c7a5470c521eb04582f71d01f24f4b48940c46
python-rgw-12.2.4-30.el7cp.x86_64.rpm	SHA-256: af5ef9e97fa8869c015e992069ecf4ae57e968dd853aca7c35fc63e7a96dd5a1

Red Hat Ceph Storage OSD 3

SRPM
ceph-12.2.4-30.el7cp.src.rpm	SHA-256: 611b9e33fe39c5b18e7d13cbf90223b04db7d1080a23928ece65b1bb699ff512
cephmetrics-1.0.1-1.el7cp.src.rpm	SHA-256: e3a789d1a267f95180722d75a4a3ce1b3b03b44317c231499cc78783ce3bdc00
x86_64
ceph-base-12.2.4-30.el7cp.x86_64.rpm	SHA-256: ea6de0e8d665fefd37430b49c1ee62508f80aeea911b52618788881b79455773
ceph-common-12.2.4-30.el7cp.x86_64.rpm	SHA-256: dc561f1db96dc42c5c4221da59c6a9df8ed0b8f709da6dd9eff6aef20a902042
ceph-debuginfo-12.2.4-30.el7cp.x86_64.rpm	SHA-256: 8e482136de956a90099c6326d21d5551e61eb2c264deacc3a18e71839d58a37f
ceph-osd-12.2.4-30.el7cp.x86_64.rpm	SHA-256: 5aaad9f1e4549598493006414f30e4af4b389fa8cdf841f0edf26f51fbb05674
ceph-selinux-12.2.4-30.el7cp.x86_64.rpm	SHA-256: 13a7e75fc0a02e42a74251755a3183f743bb290c6b8b73ed25cb5bff6246ff28
ceph-test-12.2.4-30.el7cp.x86_64.rpm	SHA-256: cf38941e51c54e6a2cecb25c7be0ea250ca55353261b4fe699ed692f82bd0d91
cephmetrics-collectors-1.0.1-1.el7cp.x86_64.rpm	SHA-256: 003b9a105145722c88eec833c486f43d74f1ff55801ee28a39e26d703a617496
libcephfs-devel-12.2.4-30.el7cp.x86_64.rpm	SHA-256: 7e8690e0b505603c4e7850ace8a6269f7636331a65c6f9431aad39f549acf82f
libcephfs2-12.2.4-30.el7cp.x86_64.rpm	SHA-256: 91ce5f5d60565b9d024ddfb4f6696f061d6b708949d65b733de3c09a41248151
librados-devel-12.2.4-30.el7cp.x86_64.rpm	SHA-256: 2b6e6282f24376641ec1cbfa8af0bb2a00770a7e113dc732143917d26be09668
librados2-12.2.4-30.el7cp.x86_64.rpm	SHA-256: dd8829ca9d3c7f37d1b341fe610b04e7fa70e93e738e61909481927648f8bb6d
libradosstriper1-12.2.4-30.el7cp.x86_64.rpm	SHA-256: 691c6e1078d04983a1e8970f2bb97d9ba91a936ac7dd489fa3fc16bc386f1992
librbd-devel-12.2.4-30.el7cp.x86_64.rpm	SHA-256: 9374cffa02877d50af3b6785ad502fd5aab1072e3a83693f7f2a92d8452daead
librbd1-12.2.4-30.el7cp.x86_64.rpm	SHA-256: a93851db92dfc4197674e494c062bed38051936c04dfb215d7889d58de9b847e
librgw-devel-12.2.4-30.el7cp.x86_64.rpm	SHA-256: bbc164ee63aadb08bf787bbd05a7f885c84a215e816a684efa4939a5ed82c24a
librgw2-12.2.4-30.el7cp.x86_64.rpm	SHA-256: 76c07d0fc5de27fe2d4b906036c3ff56f6b74eecea9831f1680bd67e7a4a21cd
python-cephfs-12.2.4-30.el7cp.x86_64.rpm	SHA-256: d78ae7ff049d1d8fe08aa1ce25e111f3b85d1e646928235271fc169a52814f00
python-rados-12.2.4-30.el7cp.x86_64.rpm	SHA-256: 32ce0d8cb6cf8d0c60e4c6c4608fc14d497221593f6427c763b110aea8b66911
python-rbd-12.2.4-30.el7cp.x86_64.rpm	SHA-256: 38d7842386b3057df619d8b871c7a5470c521eb04582f71d01f24f4b48940c46
python-rgw-12.2.4-30.el7cp.x86_64.rpm	SHA-256: af5ef9e97fa8869c015e992069ecf4ae57e968dd853aca7c35fc63e7a96dd5a1