RHSA-2024:1383 - Security Advisory

Topic

Updated packages that include numerous enhancements and bug fixes are now available for Red Hat OpenShift Data Foundation 4.15.0 on Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat OpenShift Data Foundation is software-defined storage integrated with and optimized for the Red Hat OpenShift Container Platform. Red Hat OpenShift Data Foundation is a highly scalable, production-grade persistent storage for stateful applications running in the Red Hat OpenShift Container Platform. In addition to persistent storage, Red Hat OpenShift Data Foundation provisions a multicloud data management service with an S3 compatible API.

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

These updated packages include numerous enhancements and bug fixes. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat OpenShift Data Foundation Release Notes for information on the most significant of these changes:

https://access.redhat.com/documentation/en-us/red_hat_openshift_data_foundation/4.15/html/4.15_release_notes/index

All Red Hat OpenShift Data Foundation users are advised to upgrade to these packages that provide these bug fixes and enhancements.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat OpenShift Data Foundation 4 for RHEL 9 x86_64
• Red Hat OpenShift Data Foundation for IBM Power, little endian 4 for RHEL 9 ppc64le
• Red Hat OpenShift Data Foundation for IBM Z and LinuxONE 4 for RHEL 9 s390x
• Red Hat OpenShift Data Foundation for RHEL 9 ARM 4 aarch64

Fixes

• BZ - 2005835 - [DR] VRClass resource should not be editable after creation
• BZ - 2022467 - [RFE] enable distributed ephemeral pins on "csi" subvolume group
• BZ - 2126028 - exporter python script does not support IPV6
• BZ - 2130266 - [RFE] Deploy two MGR PODs one active and one standby
• BZ - 2151493 - [OCP Tracker] [RDR] A VR isn't marked secondary and cleanup of primary cluster remains stuck after Failover operation
• BZ - 2165128 - [RDR] DRPolicy creation is restricted if 2 different sub-versions are ODF are installed on the Managed Clusters
• BZ - 2165907 - [GSS] Noobaa-db pod is stuck in CLBO
• BZ - 2196858 - [RFE] Add role capability in rados user in ODF via rook
• BZ - 2207925 - [RDR] When performing cross cluster failover of 2 apps cleanup of app-1 is stuck and failover of app-2 is stuck
• BZ - 2208302 - ocs-metrics-exporter cannot list/watch persisentvolume
• BZ - 2209616 - test_rgw_kafka_notifications test fails with "RGW bucket notification is not working as expected." Error
• BZ - 2210970 - Data Foundation - i18n misses
• BZ - 2213885 - [RDR] [UI] When workloads are deleted via ACM UI, DRPC isn't deleted
• BZ - 2222254 - [RDR] [Tracker for Ceph BZ 2248719] Ceph reports mgr crash with Module 'devicehealth' has failed: disk I/O error
• BZ - 2228785 - [ODF][OBC] Provisioning of Radosgw OBCs with the same bucket name is successful
• BZ - 2229670 - All the Controller Operations should reach the one Controller (active) not multiple Controllers
• BZ - 2231076 - ocs-operator crashes due to a panic cause by Nil pointer dereference
• BZ - 2231860 - [Tracker] pod noobaa-db-pg-0 CrashLoopBackOff
• BZ - 2233010 - [RDR] Replace existing OSDs to use bluestore-rdr store
• BZ - 2234479 - RFE: automation around OSD removal to avoid Data Loss
• BZ - 2236384 - [RDR] When workload is deployed but progression isn't marked as Completed, both Failover & Relocate are allowed
• BZ - 2236400 - [RDR][CEPHFS] When RDR upgrade is performed volSync values are getting removed from ramen-hub configmap
• BZ - 2237427 - [MCG] Patching a replication-policy onto a used bucketclass fails with "invalid input syntax for type json "
• BZ - 2237895 - ocs-storagecluster-cephblockpool contains Raw capacity card
• BZ - 2237903 - Noobaa fails to use the new internal cert after rotation
• BZ - 2237920 - NFS-Ganesha server does not have a health checking mechanism implemented
• BZ - 2239208 - CephFS PVC Creation Fails Provision with size 500M
• BZ - 2239590 - [RDR] DRPC reports wrong Phase/Progression as Deployed/Completed the moment failover is triggered
• BZ - 2239608 - ocs-client-operator fails to reconcile CSI
• BZ - 2240756 - [UI] ODF Topology. Node details of Compact mode. Role merged to one word
• BZ - 2240908 - [RDR] [UI] DR UI allows Relocate and Failover to same peer causing the Failover to get stuck in Wait_For_Fencing progression
• BZ - 2241268 - Enabling ceph mirroring enables bluestore-rdr and OSDs fail to recreate
• BZ - 2241872 - [Tracker][27770] ocs-metrics-exporter is in CrashLoopBackOff when running in Provider/Client mode
• BZ - 2242309 - [RDR] Apps don't get DR protected when drpolicy gets validated after applying it to those apps
• BZ - 2244568 - [noobaa-operator clone] Redundant dependency on Vault library - should be removed
• BZ - 2244569 - [csi-driver clone] Redundant dependency on Vault library - should be removed
• BZ - 2244570 - [mco clone] Redundant dependency on Vault library - should be removed
• BZ - 2245004 - rook-ceph-rgw-ocs-storagecluster-cephobjectstore-a does not come up after node reboot
• BZ - 2246084 - [RDR] [Hub recovery] Failover doesn't complete
• BZ - 2246993 - StoraegProfile CRs are mutable upon creation
• BZ - 2247094 - [IBM Z ] - [ODF deployment] - [multipath device] - StorageSystem creation from webUI using local storage devices does not select multipath devices by default
• BZ - 2247313 - rook-ceph-osd-prepare pods in CLBO during Installation
• BZ - 2247518 - [RDR] [Hub recovery] If the primary managed cluster along with active hub goes down, VolumeSynchronizationDelay alert is not fired on Passive Hub even when monitoring label is applied
• BZ - 2247542 - [RDR] [Hub-recovery] Failover didn't succeed for cephfs backed workloads
• BZ - 2247714 - [RDR][Hub Recovery] Fixing DRPC after hub recovery for failover/relocate can lead to data loss
• BZ - 2247731 - [GSS] Noobaa Operator Does not update Secret with FIPS enabled
• BZ - 2247743 - Ensure provider api server allows empty platform and operator version
• BZ - 2247748 - [Tracker][29042] The storage-client CronJob create too many jobs
• BZ - 2248117 - Backup failing to transfer data: snapshot PVC in pending state
• BZ - 2248664 - [RDR] [Hub recovery] A workload which was in failedover state before hub recovery goes to cleaning up on passive hub
• BZ - 2248666 - [RDR] [Hub recovery] DRCluster post secret creation goes to exponential backoff and takes too long to get validated
• BZ - 2248684 - metric ocs_storage_client_operator_version is returning -1
• BZ - 2248832 - Revert The ocs-osd-removal-job should have unique names for each Job
• BZ - 2249678 - the multus network address detection job does not derive placement configs from CephCluster "all" placement
• BZ - 2249844 - [CEPH bug 2249814 tracker] Health Warn after to upgrade to 4.13.5-6 - 1 daemons have recently crashed
• BZ - 2250092 - Unsuccessful retrieval of a data pool isn't properly captured
• BZ - 2250152 - [RDR] [Hub recovery] Sync for all cephfs workloads stopped post hub recovery
• BZ - 2250636 - Do not create Virtualization storage class in Provider mode
• BZ - 2250911 - [UI] [OCPBUGS-25881 Tracker] In Openshift-storage-client namespace, 'RWX' access mode RBD PVC with Volume mode 'Filesystem' is not blocked, it attempt to create and stuck in pending state
• BZ - 2250995 - [Tracker][29079] rook-ceph-exporter pod restarts multiple times on a fresh installed HCI cluster
• BZ - 2251741 - MCG endpoint minCount and maxCount in ocs-storagecluster are ignored
• BZ - 2252035 - Discrepancy shown when viewing storage metrics - (but product can continue to work)
• BZ - 2252756 - [RDR] [Hub recovery] [CephFS] volumes are lost on the secondary managed cluster after hub recovery
• BZ - 2253185 - [GSS] During installation of ODF 4.14 'rook-ceph-rgw-ocs-storagecluster-cephobjectstore-a pod' stuck in CrashLoopBackOff state
• BZ - 2253257 - [RDR] DR cluster operator goes to failed state after adding the ODF cluster to AHCM
• BZ - 2253953 - noobaa-core-0 in CLBO in disconnected deployment mode
• BZ - 2254159 - odf prep script for odf-external doesn't honour the --run-as-user parameter
• BZ - 2254216 - [Provider-Client deployment] storageclient-status-reporter CLBO. storageclass claims stuck in configuring
• BZ - 2254330 - [UI] No Backing store elements create btn, list, other, OCP 4.15, ODF 4.14
• BZ - 2254333 - [UI] ceph blockpool page crushed OCP 4.15, ODF 4.14
• BZ - 2254513 - [Eng. Enhancement] Create a separate go module for ocs-operator APIs
• BZ - 2255036 - External storage system stats on data foundation page shows only zeros when multi storagecluster installed
• BZ - 2255194 - Provide subscription based application details also in the dr dashboard
• BZ - 2255219 - UI re-installation of external mode in multi storagecluster fails because the namespace exists
• BZ - 2255232 - rook-ceph-rgw-ocs-storagecluster-cephobjectstore warning when deployed on control-plan
• BZ - 2255240 - Must gather in 4.15 is not collected in 35 mins
• BZ - 2255241 - Upgrade to 4.15 is blocked
• BZ - 2255310 - odf-operator should update it's upgradeable conditions based on the dependents
• BZ - 2255320 - remove incompatible provider api changes for onboarding clients
• BZ - 2255328 - Rook-ceph-exporter pods not available in ODF 4.15
• BZ - 2255332 - [DR] UI needs textual updates (for 4.15 epics)
• BZ - 2255333 - [ODF] UI needs textual updates (for 4.15 epics)
• BZ - 2255340 - Not Found error is shown in Configure modal for CephMonCountLow Alert
• BZ - 2255343 - External Storage cluster(ocs-external-storagecluster) showing in error state
• BZ - 2255411 - Separate out the go.mod for the API package to reduce dependency problems
• BZ - 2255491 - Add 'managedBy' label to rook-ceph-exporter metrics and alerts
• BZ - 2255499 - [4.15 backport][ocs-operator] Backport fusion hci phase 2 related changes from main to 4.15 branch
• BZ - 2255501 - [4.15 backport][ocs-client-operator] Backport fusion hci phase 2 related changes from main to 4.15 branch
• BZ - 2255508 - [4.15 backport][odf-console] Backport fusion hci phase 2 related changes from main to 4.15 branch
• BZ - 2255557 - Noobaa stuck configuring when deploying on IBM Cloud(IPI) with COS-backed backingstore
• BZ - 2255586 - Noobaa backingstore noobaa-default-backing-store-noobaa-noobaa not found
• BZ - 2255890 - [4.15 backport][odf-operator] Backport fusion hci phase 2 related changes from main to 4.15 branch
• BZ - 2256085 - [UI] Styles (CSS) are broken at certain places
• BZ - 2256161 - MDS pod in CrashLoopBackOff due to Liveness probe failure
• BZ - 2256456 - Provide better logging for ocs-metrics-exporter
• BZ - 2256566 - [UI]Setting up the Default StorageClass option as RBD is not working with an external mode cluster.
• BZ - 2256580 - PVC label selector should not recommend labels that don't work, they should be filtered
• BZ - 2256597 - Ceph reports 'MDSs report oversized cache' warning, yet there is no observed alert for high MDS cache usage
• BZ - 2256633 - [UI][MDR] Application showing wrong status of protected PVC but main dashboard showing healthy
• BZ - 2256637 - [Tracker: Bug #2256731] change priority of mds rss perf counter to useful
• BZ - 2256725 - The MDSCacheUsageHigh alert is lacking a call to action
• BZ - 2256777 - [provider] During regression testing RGW pod rook-ceph-rgw-ocs-storagecluster-cephobjectstore on provider went to CLBO state
• BZ - 2257222 - [RDR] Optimise cluster for RDR daialog fails with error msg
• BZ - 2257296 - NFS-Ganesha RPC liveness probe is not properly enabled
• BZ - 2257310 - The MDSCPUUsageHigh alert is lacking a call to action
• BZ - 2257427 - After deletion of onboarding-ticket-key the onboarding ticket generation job did not re-trigger
• BZ - 2257441 - [UI] System raw capacity card is not showing external mode StorageSystem
• BZ - 2257634 - Add Runbooks for ODF alerts - no links, wrong text, sublinks not work
• BZ - 2257674 - rook-ceph operator don't have permissions to create ServiceMonitor on external namespaces
• BZ - 2257694 - multicluster mode ocs-metrics-exporter issues: unable to collect PV data or to get CSI config
• BZ - 2257711 - ocs-metrics-exporter is not updated when ocs-operator is upgraded
• BZ - 2257982 - Noobaa system failed to create using external postgres - db_url link is not correct
• BZ - 2258015 - Client onboarding token generation from UI is not working for upgraded provider clusters
• BZ - 2258021 - OSD cpu overutilization alert is raised during normal fio workloads
• BZ - 2258351 - [RDR] [Hub recovery] [Co-situated] Failover did not progress after site failure
• BZ - 2258357 - Storagecluster is in warning state on IBM Power cluster due to "no active mgr" error
• BZ - 2258560 - [RDR] [Hub recovery] [Co-situated] MCO didn?t create VRCs after hub recovery which hinders failover operation
• BZ - 2258591 - Error 'Invalid image health, "", for pool ocs-storagecluster-cephblockpool' in ocs-metrics-expoter logs
• BZ - 2258681 - Backingstore Reconcilliation happening over 2000 times an hour
• BZ - 2258744 - odf-cli tool - ceph does not have option to set log-level in release-4.15
• BZ - 2258814 - Missing initial mon count value in "CephMonLowNumber" configure modal
• BZ - 2258937 - [Provider-Client] Additional subvolumegroups created on provider cluster
• BZ - 2258974 - [Tracker for https://github.ibm.com/ProjectAbell/abell-tracking/issues/31423?] Even after DF client installed on Hosted cluster , connection :- Unknown and storage status :- Installing (Upgraded ODF)
• BZ - 2259187 - [RDR] Osd migration has halted in between
• BZ - 2259476 - Missing initial mon count value in "CephMonLowNumber" configure modal
• BZ - 2259632 - ocs-metrics-exporter: ocs_rbd_pv_metadata is missing
• BZ - 2259664 - Static name for cephfs and RBD CSI driver deployed by ocs-client-operator
• BZ - 2259773 - Add translations for ODF 4.15 release
• BZ - 2259852 - Alert "CephMonLowNumber" not triggered for rack,host based failure domains
• BZ - 2260050 - Enabling Replica-1 from UI is not working on LSO backed ODF on IBM Power cluster
• BZ - 2260131 - Health is going in Warning state after patching the storagecluster for replica-1 in ODF4.15 on IBM Power cluster
• BZ - 2260279 - Exporter deployment recreation with each Ceph daemon creation causes unnecessary reconciles
• BZ - 2260340 - CephMonLowNumber alert is raised only when metrics exporter pod is restarted
• BZ - 2260818 - Additional failure domain is shown in Configure Ceph Monior UI tab
• BZ - 2261936 - Collect csidriver related details in the must-gather
• BZ - 2262052 - default multisite zonegroup creation should contain realm
• BZ - 2262252 - ocs-storagecluster is in progressing state due to noobaa in configuring state
• BZ - 2262376 - OCS Client operator is not listed in the UI due to the non-standalone annotation, making upgrade through UI impossible
• BZ - 2262974 - Noobaa system failed to create using external postgres - externalPgSSLRequired is always set true
• BZ - 2263319 - Replica-1 configuration fails with cephcluster spec invalid value
• BZ - 2263472 - change the sample yaml in the CSV
• BZ - 2263984 - Noobaa system failed to create using external postgres - no noobaa CR is created
• BZ - 2264002 - Log SiteStatuses details and description in GetVolumeReplicationInfo RPC call
• BZ - 2264825 - [UI][MDR] User-1 can delete application created by user-2
• BZ - 2265051 - ocs-storagecluster is in progressing state due to noobaa in configuring state due to tls: failed to verify certificate: x509: certificate signed by unknown authority
• BZ - 2265109 - NooBaaNamespaceBucketErrorState and NooBaaNamespaceResourceErrorState are not triggered when namespacestore's target bucket is deleted
• BZ - 2265124 - [4.15] Move cephFS fencing under a new flag to trigger networkFence
• BZ - 2265514 - "unable to get monitor info from DNS SRV with service name: ceph-mon" error observed while creating fedora app pod
• BZ - 2266564 - The CSV and COMET for all ODF's component operators are missing subscription information
• BZ - 2266583 - Number failure domain value is hardcoded in CephMonLowNumber alert
• BZ - 2267209 - collect logs of the external cluster in the openshift-storage-extended namespace for multi storage cluster
• BZ - 2267712 - ODF client operator has nondescript information on the operator hub
• BZ - 2267857 - noobaa instance is initializating due to panic: reflect.Value.Interface: cannot return value obtained from unexported field or method
• BZ - 2267885 - [RDR] [Hub recovery] [Co-situated] Missing VRCs blocks failover operation for RBD workloads
• BZ - 2268407 - must-gather is not collecting ceph commands output
• BZ - 2268959 - After upgrade, noobaa is in initialization state due system.read_system() Response Error: Code=UNAUTHORIZED Message=account not found 65ec27f52e541700269b2156

CVEs

• CVE-2021-35937
• CVE-2021-35938
• CVE-2021-35939
• CVE-2023-3462
• CVE-2023-5363
• CVE-2023-5954
• CVE-2023-5981
• CVE-2023-7104
• CVE-2023-24532
• CVE-2023-26159
• CVE-2023-27043
• CVE-2023-28486
• CVE-2023-28487
• CVE-2023-29406
• CVE-2023-29409
• CVE-2023-39318
• CVE-2023-39319
• CVE-2023-39321
• CVE-2023-39322
• CVE-2023-39615
• CVE-2023-42282
• CVE-2023-42465
• CVE-2023-43646
• CVE-2023-43804
• CVE-2023-45803
• CVE-2023-46218
• CVE-2023-48631
• CVE-2023-48795
• CVE-2023-51385
• CVE-2024-0553
• CVE-2024-0567

References

• https://access.redhat.com/security/updates/classification/#important
• https://access.redhat.com/documentation/en-us/red_hat_openshift_data_foundation/4.15/html/4.15_release_notes/index