RHSA-2021:2445 - Security Advisory

Topic

An update for ceph, ceph-ansible, ceph-iscsi, python-waitress, and tcmu-runner is now available for Red Hat Ceph Storage 4.2.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable version of the Ceph storage system with a Ceph management platform, deployment utilities, and support services.

The ceph-ansible package provides Ansible playbooks for installing, maintaining, and upgrading Red Hat Ceph Storage.

The tcmu-runner packages provide a service that handles the complexity of the LIO kernel target's userspace passthrough interface (TCMU). It presents a C plugin API for extension modules that handle SCSI requests in ways not possible or suitable to be handled by LIO's in-kernel backstores.

Security Fix(es):

• ceph: Unauthorized global_id reuse in cephx (CVE-2021-20288)
• ceph-dashboard: Don't use Browser's LocalStorage for storing JWT but Secure Cookies with proper HTTP Headers (CVE-2020-27839)
• ceph-dashboard: Cross-site scripting via token Cookie (CVE-2021-3509)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

These updated packages include numerous bug fixes. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Ceph Storage 4.2 Release Notes for information on the most significant of these changes:

https://access.redhat.com/documentation/en-us/red_hat_ceph_storage/4.2/html/release_notes/index

All users of Red Hat Ceph Storage are advised to upgrade to these updated packages, which provide numerous bug fixes.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Ceph Storage MON 4 for RHEL 8 x86_64
• Red Hat Ceph Storage MON 4 for RHEL 7 x86_64
• Red Hat Ceph Storage OSD 4 for RHEL 8 x86_64
• Red Hat Ceph Storage OSD 4 for RHEL 7 x86_64
• Red Hat Enterprise Linux for x86_64 8 x86_64
• Red Hat Ceph Storage for Power 4 for RHEL 8 ppc64le
• Red Hat Ceph Storage for Power 4 for RHEL 7 ppc64le
• Red Hat Ceph Storage MON for Power 4 for RHEL 8 ppc64le
• Red Hat Ceph Storage MON for Power 4 for RHEL 7 ppc64le
• Red Hat Ceph Storage OSD for Power 4 for RHEL 8 ppc64le
• Red Hat Ceph Storage OSD for Power 4 for RHEL 7 ppc64le
• Red Hat Ceph Storage for IBM z Systems 4 s390x
• Red Hat Ceph Storage MON for IBM z Systems 4 s390x
• Red Hat Ceph Storage OSD for IBM z Systems 4 s390x

Fixes

• BZ - 1766702 - reweight-subtree does not trigger peering
• BZ - 1775096 - Ceph 4 building obsolete version of package python-waitress
• BZ - 1826224 - progress section in ceph status stuck for indefinite time
• BZ - 1859181 - mds: send scrub status to ceph-mgr only when scrub is running (or paused, etc..)
• BZ - 1878771 - [cee/sd][MDS] after kernel upgrade from RHEL7.8 to RHEL8.2 the MDS memory consumption is growing until OOM
• BZ - 1882086 - MDS assert in directory commit
• BZ - 1882087 - ceph-fuse assert in directory cache
• BZ - 1882089 - client passes wrong cap mask to path_walk
• BZ - 1882091 - [CodeChange] MDS crash when stopping
• BZ - 1884463 - [GSS] ceph fs status command failing with AttributeError exception
• BZ - 1892406 - libcephfs leaks inode reference
• BZ - 1892408 - MDS hits assert when shrinking max_mds
• BZ - 1896040 - [GSS][Tracker for bug 1895819] Ceph MON daemon Segmentation fault in PerfCounters::inc() during shutdown
• BZ - 1896461 - [CodeChange] concurrent client mkdir may fail
• BZ - 1896464 - [CodeChange] libcephfs Client::_read may fail to advance file pos at EOF checking
• BZ - 1896465 - mds may crash during recovery when replaying delayed requests
• BZ - 1900111 - mds: throttle workloads which acquire caps faster than the client can release
• BZ - 1901330 - CVE-2020-27839 ceph-dashboard: Don't use Browser's LocalStorage for storing JWT but Secure Cookies with proper HTTP Headers
• BZ - 1902752 - MDS directory bookkeeping does not dirty fragments in some cases
• BZ - 1902753 - libcephfs allows calling ftruncate on a file open read-only
• BZ - 1903504 - [GSS][ceph-ansible] rolling-update.yml fails with: TASK [ceph-container-common : container registry authentication]
• BZ - 1905431 - [GSS][RFE] Optimize PG removal for huge number of objects in Red Hat Ceph Storage 4
• BZ - 1906262 - Various potential crashes are possible if snapshot mirroring is behind
• BZ - 1906305 - pg_autoscale_mode should be a choice between on/off/warn and not ture/false
• BZ - 1906447 - [GSS] ceph osd df tree reporting incorrect SIZE value for rack having an empty host node
• BZ - 1906627 - In-use snapshot can be prematurely deleted if replay is backlogged
• BZ - 1909011 - [ceph-ansible] : switch from rpm to containerized - waiting for quorum task failing saying container not found despite container exists
• BZ - 1909760 - libcephfs directory st_size no updated after writes into directory
• BZ - 1909762 - some libcephfs rstat checks do not acquire necessary caps
• BZ - 1910151 - [cee/sd][ceph-ansible] Monitor updates using site-container.yml fails when cephx is disabled
• BZ - 1917680 - cluster upgrade from 4.2 to 4.2z1 error out as MON went down - MON restart gave error - Failed to restart ceph-mon@extensa011.service: Unit is masked.
• BZ - 1918650 - [RFE] [ceph-ansible] : Rolling update fails to enable tools repo and does not login to docker registry in grafana node
• BZ - 1919084 - [GSS][ceph-ansible] Creating OSD with device name as by-path fails if we are using dedicated_devices.
• BZ - 1919471 - [cee/sd][ceph-mgr][balancer] After upgrade from 3.3 to 4.2 balancer fails with unhandled exceptions
• BZ - 1920900 - [RHCS4.2] delete the unused files after purging cluster
• BZ - 1921798 - data corruption with snapshot-based mirroring
• BZ - 1922926 - ceph purge yml not clear the lvm's on bluestore DB drives.
• BZ - 1925503 - [cee/sd][containerized][ceph-ansible] when running site-container.yml with '--limit' on co-located nodes, the playbook fails on RUNNING HANDLER [ceph-handler : unset noup flag] triggering non-containerized version of command
• BZ - 1925506 - CEPH4.1: RadosGW: Large file upload fails with 416 ERANGE bug
• BZ - 1925646 - [RHOSP 16.1] manila with cephfs using nfs doesn't honor Squash = None provided in the ganesha export template during share creation
• BZ - 1926170 - [GSS] ceph-ansible : Failing to add iSCSI gateway when ipv6 address is used in public_network
• BZ - 1927869 - Backport ms_mode mapping option (krbd support for msgr2)
• BZ - 1928000 - [GSS][ceph-dashboard] Increasing the retention period for Prometheus in RHCS 4
• BZ - 1928785 - Add msgrv2 support to mount.ceph
• BZ - 1930180 - pybind/mgr/volumes: inherited snapshots should be filtered out of snapshot listing
• BZ - 1930264 - [CEE] [RR Cluster] OSD hitting slow request during cluster upgrade from RHCS 3.3z4 to RHCS 4.1z3
• BZ - 1933721 - python libcephfs DT_REG and DT_LNK values are wrong
• BZ - 1934092 - Ceph iSCSI: fallocate(PUNCH_HOLE) succeeds, storage is not zeroed if length not aligned
• BZ - 1935406 - Use ansible_facts
• BZ - 1938031 - CVE-2021-20288 ceph: Unauthorized global_id reuse in cephx
• BZ - 1941678 - MDS may fetch of large dirfrag races with dirfrag commits
• BZ - 1942444 - [ceph-ansible] [RBD] [rbdmirror] : Two way RBD mirroring using ceph ansible does not enable RBD mirroring on the clusters
• BZ - 1943391 - filestore-to-bluestore.yml Ansible Playbook removes or adds all OSDs on a node during subsequent runs
• BZ - 1944996 - [ceph-ansible] [rpmtocontainer] : switch-from-non-containerized-to-containerized-ceph-daemons.yml playbook does not wait for long enough for the containers to be created
• BZ - 1944999 - [ceph-ansible] [rpmtocontainer] : switch-from-non-containerized-to-containerized-ceph-daemons.yml fails and directly disables all the ceph target services
• BZ - 1945920 - ceph-fuse items pinned in cache preventing unmount
• BZ - 1946263 - volumes plugin may deadlock in ceph-mgr finisher thread
• BZ - 1946536 - [GSS] rbd-target-api daemon failing with IndexError: list index out of range Error
• BZ - 1946987 - [RFE] [ceph-ansible] : Support for migration of iscsi daemons to container using switch-from-non-containerized-to-containerized-ceph-daemons.yml playbook
• BZ - 1947215 - [GSS] bluestore scrub memory growth due to low bluestore_cache_trim_max_skip_pinned
• BZ - 1947673 - 'rbd trash purge' gets hung on rbds with clones or snapshots and should skip to continue progress [4.2z2]
• BZ - 1947695 - Ceph dashboard deployment on RHOSP 16.1.4 HCI does not configure prometheus to scrape HCI compute nodes
• BZ - 1949391 - Failover for Ceph Dashboard on RHOSP is not working due to hardcoded bootstrap controller IP
• BZ - 1949489 - [ceph-ansible] mon service fails and ceph-ansible fails to create containers when /var/log/ceph directory is not present after an OS upgrade
• BZ - 1949490 - [ceph-ansible] [dockertopodman] dockertopodman playbook fails because of target service in not-found state
• BZ - 1950116 - CVE-2021-3509 ceph-dashboard: Cross-site scripting via token Cookie
• BZ - 1951386 - rgw-orphan-list tool consuming more space than expected 4.2
• BZ - 1952011 - [RGW][SSE-KMS: Vault] Add Support customed CA certificate from vault KMS for SSE encryption
• BZ - 1952466 - rgw: nautilus: keystone: backport keystone S3 credential caching
• BZ - 1952570 - RGW does not support '_' symbol in S3 metadata records.
• BZ - 1954748 - rgw: multipart re-uploads can have NUL char in rados object name and breaks rgw-orphan-list
• BZ - 1954789 - RGW ops log is not logging bucket listing operations
• BZ - 1954819 - tools/rados: omnibus NUL character in object name commits 4.2
• BZ - 1955218 - monitor db can fill up with cluster log messages
• BZ - 1955782 - Ceph Monitors incorrectly report slow operations
• BZ - 1958362 - rbd_support: Attempting to background remove images with clones results in apparent stuck progress
• BZ - 1959254 - [GSS][OCS 4.6.4][Wrong timestamp displayed in the bucket event notifications received]
• BZ - 1959452 - After upgrade from RHCS 3 to RHCS 4.1 slowness experienced with radosgw-admin command
• BZ - 1962077 - [Ceph-Ansible] Ceph Installation got failed at TASK [ceph-dashboard : create dashboard admin user]
• BZ - 1963066 - filestore to bluestore migration fails due to undesired filter match
• BZ - 1963914 - [Ceph-Dashboard] API docs link broken
• BZ - 1963962 - rbd-mirror: segfault in snapshot replayer on shutdown
• BZ - 1964144 - segfault when removing a mirror snapshot with multiple peers
• BZ - 1964481 - RGW daemons in failed state during upgrade to 4.2 with "ERROR: failed to initialize data log: (5) Input/output error"
• BZ - 1964835 - ceph-crash daemon deployment broken in containerized deployment when running the main playbook with --limit
• BZ - 1964907 - Installing 4.2 cluster on rhel-7 fails while enabling Tools repo for grafana node
• BZ - 1964995 - [RGW Multisite] RGW multisite configuration fails on a 4.2z2 cluster
• BZ - 1966880 - Ceph-Ansible doesn't ensure Ceph Dashboard (grafana-server) sends cookies with "secure" attribute
• BZ - 1967341 - OSDs are not being flagged as nearfull after crossing nearfull ratio set

CVEs

• CVE-2020-27839
• CVE-2021-3509
• CVE-2021-20288

References

• https://access.redhat.com/security/updates/classification/#important