RHSA-2024:8676 - Security Advisory

Topic

Updated images that include numerous enhancements, security, and bug fixes are now available for Red Hat OpenShift Data Foundation 4.17.0 on Red Hat Enterprise Linux 9.

Description

Red Hat OpenShift Data Foundation is software-defined storage integrated with and optimized for the Red Hat OpenShift Container Platform. Red Hat OpenShift Data Foundation is a highly scalable, production-grade persistent storage for stateful applications running in the Red Hat OpenShift Container Platform. In addition to persistent storage, Red Hat OpenShift Data Foundation provisions a multicloud data management service with an S3 compatible API.

These updated packages include numerous enhancements and bug fixes. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat OpenShift Data Foundation Release Notes for information on the most significant of these changes:

https://docs.redhat.com/en/documentation/red_hat_openshift_data_foundation/4.17/html/4.17_release_notes/index

All Red Hat OpenShift Data Foundation users are advised to upgrade to these packages that provide these bug fixes and enhancements.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat OpenShift Data Foundation 4 for RHEL 9 x86_64
• Red Hat OpenShift Data Foundation for IBM Power, little endian 4 for RHEL 9 ppc64le
• Red Hat OpenShift Data Foundation for IBM Z and LinuxONE 4 for RHEL 9 s390x
• Red Hat OpenShift Data Foundation for RHEL 9 ARM 4 aarch64

Fixes

• BZ - 2059669 - [DR] Application namespace left behind in managed clusters after deleting the application
• BZ - 2190161 - Support to reject CephFS clones if cloner threads are not available.
• BZ - 2219310 - CVE-2023-26136 tough-cookie: prototype pollution in cookie memstore
• BZ - 2241329 - [RDR] [Hub recovery][4.15 clone][ With passive hub, sync stops for all rbd and cephfs workloads, rgw on one of the managed clusters goes down
• BZ - 2245068 - [GSS] ODF console topology page is throwing error "TypeError: a metadata.ownerReference is undefined"
• BZ - 2250364 - CVE-2023-26364 css-tools: Improper Input Validation causes Denial of Service via Regular Expression
• BZ - 2253013 - Ceph storage pool created with pg_num and pgp_num 1; osd_pool_default_pg_num is 32, must set deviceClass on all pools
• BZ - 2257271 - [RFE] Generate odf external upgrade parameters, for external python script
• BZ - 2259668 - Network fence with rbd_csi driver gets created upon cephfs volume recovery
• BZ - 2262777 - [Non Contanerized NSFS] Node CLI is not honoring the default value while doing health check
• BZ - 2268046 - CVE-2024-24786 golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON
• BZ - 2268820 - CVE-2024-28176 jose: resource exhaustion
• BZ - 2271773 - KMSServerConnectionAlert not raised when KMIP KMS connection is unavailable
• BZ - 2272597 - [ODF used capacity trend] average usage and days left predictions are incorrect
• BZ - 2275225 - Average and 'Estimated days to fill' goes wrong after mgr failover.
• BZ - 2275965 - "Average" and "Estimated days to fill" are showing a value '0' always in consumption trend.
• BZ - 2276393 - [UI] Provider mode. Page crash on StorageSystem - Object - Performance
• BZ - 2276672 - "Average" of storage consumption per day is greater than the total used capacity.
• BZ - 2279751 - Few pods under openshift-storage namespace doesnot contain 'node.ocs.openshift.io/storage' toleration
• BZ - 2279876 - [cee/sd][ODF] MDS pod scheduling blocked on hybrid clusters /w two Cephfs instances
• BZ - 2280308 - [MDR][RDR][Discovered Apps]: Add Cleanup check and message for relocation action
• BZ - 2280608 - [UI] For Providers under StorageClients page col-2 should have storageclient cluster name and in brackets the cluster id
• BZ - 2280637 - The rook-ceph-csi scc does not have "Required Drop Capabilities" set
• BZ - 2283994 - [RDR] Message in WorkloadUnprotected warning alert is misleading when lastGroupSyncTime is reset after failover
• BZ - 2292435 - ODF ceph quorum lost during removal of extra mon
• BZ - 2292668 - CVE-2024-24789 golang: archive/zip: Incorrect handling of certain ZIP files
• BZ - 2294234 - [RDR} Discovered Application status in UI is not synced with Failover progression phase
• BZ - 2294723 - [GSS] Bucket class is stuck in configuring phase with error "Tier already exists" on updating placement policy from Spread to Mirror
• BZ - 2297265 - after upgrade from 4.15.15 to 4.15.18 image registry pods are stuck at ?container creating?
• BZ - 2297295 - [UI] Hide "builtin-mgr" block pool CR
• BZ - 2297447 - [RDR/MDR] [UI] Create DRPolicy page is breaking "Oh no! Something went wrong"
• BZ - 2297454 - CephFS additional data pools: duplicated entries at the CR level.
• BZ - 2299630 - RBD PVC creation fails with error "error generating accessibility requirements: no available topology found"
• BZ - 2299639 - [Tracker-ACM-12354][MDR][RDR]: ACM 2.11 and MCE 2.6 fails in OCP 4.17
• BZ - 2300021 - [UI] Ceph storage pool created with pg_num and pgp_num 1; osd_pool_default_pg_num is 32, must set deviceClass on all pools
• BZ - 2300312 - serviceaccount openshift-storage:rook-ceph-mgr cannot watch resource
• BZ - 2300331 - Upgrade to 4.17 fails on NooBaa schema upgrade for pool owner
• BZ - 2300499 - CVE-2024-41818 fast-xml-parser: ReDOS at currency parsing in currency.js
• BZ - 2301889 - nooba-operator pod is is consistently entering CLBO
• BZ - 2302201 - Mon Pods are in CrashLoopBackOff with msg /builddir/build/BUILD/ceph-19.1.0-0-g9025b9024ba/src/osd/OSDMap.cc: 3286: FAILED ceph_assert(pg_upmap_primaries.empty())
• BZ - 2302257 - [RDR]odfmo-controller-manager is in CLBO
• BZ - 2302448 - [MDR][RDR] UI is not allowing to create DRpolicy with error could not retrieve managed cluster information.
• BZ - 2302507 - Backingstore Stuck "Connecting" post ODF v4.15 Upgrade - INVALID_SCHEMA_REPLY SERVER system_api#/methods/read_system
• BZ - 2302575 - [GSS] When applying an OBC to a deployment the error: 'Address form errors to proceed' is shown
• BZ - 2302774 - Do not add annotation for KeyRotation on StorageClasses
• BZ - 2302841 - [RDR] Last snapshot synced is missing for appset based apps on the DR monitoring dashboard
• BZ - 2302842 - [MCG-4.17] noobaa-core pod doesn't dismount noobaa-bucket-logging-volume when disabling or changing Guaranteed Bucket Logs config at noobaa CR
• BZ - 2303028 - Do not add annotation for KeyRotation on StorageClasses
• BZ - 2303342 - Want full-support of "odf set full/nearful/backfillfull"
• BZ - 2303403 - [MCG-4.17] Guaranteed bucket logging fails with due to "unexpected error in consuming log file"
• BZ - 2303619 - Azure KMS configuration broken: dial tcp: address ....vault.azure.net/: missing port in address
• BZ - 2303820 - [mcg-bundle] Fix the capabilities in the CSV
• BZ - 2303821 - [ocs-client-bundle] Fix the capabilities in the CSV
• BZ - 2303822 - [csi-addons-bundle] Fix the capabilities in the CSV
• BZ - 2303823 - [odr-bundles] Fix the capabilities in the CSVs
• BZ - 2303824 - [odf-multicluster-bundle] Fix the capabilities in the CSV
• BZ - 2303825 - [rook-bundle] Fix the capabilities in the CSV
• BZ - 2303829 - OCS Operator is not exposing the NamespacedName of the odfInfo configmap
• BZ - 2304073 - remove client-op deployed subscription webhook before it is scaled down by odf-op
• BZ - 2304231 - Integrate cephcsi operator with OCS Client Operator
• BZ - 2304232 - Integrate cephcsi operator with OCS Client Operator
• BZ - 2304235 - ocs-client-op should deploy webhook and intercept subscription changes only when managing CSI
• BZ - 2304238 - failed to create pod on ocs-storagecluster-cephfs volume
• BZ - 2304799 - Day2 operation/Edit storage quota not uodating quota at client side
• BZ - 2304810 - include the nfs roles, bindings and service accounts in the CSV
• BZ - 2304815 - Add log rotation for the CephCSI pods
• BZ - 2304993 - [RDR] The Disaster Recovery web console page (All Clusters -> Data Services -> Disaster Recovery) is not opening and throws an error most of the time.
• BZ - 2305274 - Provide a mechanism for build team to change the kube-rbac-proxy image
• BZ - 2305295 - incorrect csi-attacher image value during build time is bundled
• BZ - 2305660 - failed to provision voumes with StorageClass "ocs-storagecluster-ceph-rbd", error fetching configuration for cluster ID "openshift-storage": open /etc/ceph-csi-config/config.json
• BZ - 2305880 - [RDR] Remove disaster recovery button remains enabled even after 1st click
• BZ - 2306026 - ocscsi-controller-manager pod does not have the name prefix of the operator name which is cephcsi-operator
• BZ - 2306387 - cephblockpool: allow editing the mirroring field from different controller
• BZ - 2306577 - [External] Not getting expected json output from
• BZ - 2307823 - [Provider mode [ISF 2.8.1] tracker #40674] Need a change in gRPC server name while creating native client.
• BZ - 2307835 - Add log rotation for the CephCSI pods
• BZ - 2307909 - [RDR] Disable DR stuck when using drpolicy without flattening with a cloned/snapshot pvc based workload
• BZ - 2308091 - CephFS networkfence CIDR ip remains in blocklisted state in ceph for long time post unfencing
• BZ - 2308101 - Add log rotation for the CephCSI pods
• BZ - 2308144 - Incorrect JSON Key Casing and Filtering Logic in createOrUpdateConfigMap Function Leads to Improper ConfigMap
• BZ - 2308193 - CVE-2024-43788 webpack: DOM Clobbering vulnerability in AutoPublicPathRuntimeModule
• BZ - 2308304 - ObjectNotFound('RADOS object not found (error calling conf_read_file) message is displayed in rook-ceph-operator log upon trying cephFS volume recovery
• BZ - 2308442 - update rook and noobaa apis and images
• BZ - 2308446 - Disconnected deployment is failing because rook-ceph-operator image is referenced via version tag instead of checksum
• BZ - 2309191 - Extra "csi-addons-" prefer is added to all resources created by csi-addons bundle
• BZ - 2309195 - KeyRotationCronJob doesn't get created for a PVC when ReclaimSpace annotation is present
• BZ - 2309485 - Add noobaa-operator dependency
• BZ - 2309486 - Disable noobaa management on client for dev preview
• BZ - 2309487 - Add support for noobaa on client clusters
• BZ - 2309488 - Added support for ocs provider server to fetch noobaa client resources
• BZ - 2309489 - Fix noobaa-account name to be storageconsumer name
• BZ - 2309700 - [MCG-4.17] Guaranteed bucket logs are not moved from the logs PVC to the logs bucket due to permission issues
• BZ - 2310369 - Selection menu shows RWO while dropdown shows RWX access mode is selected during PVC clone
• BZ - 2310385 - Upon CephFS volume recovery network fencing fails on external mode cluster
• BZ - 2310841 - Day2 operation/Edit storage quota
• BZ - 2310908 - CVE-2024-45296 path-to-regexp: Backtracking regular expressions cause ReDoS
• BZ - 2311042 - [4.17] Don't migrate OSDs from bluestore-rdr to bluestore
• BZ - 2311043 - [4.17] Don't migrate OSDs from bluestore-rdr to bluestore
• BZ - 2311152 - CVE-2024-43796 express: Improper Input Handling in Express Redirects
• BZ - 2311153 - CVE-2024-43799 send: Code Execution Vulnerability in Send Library
• BZ - 2311154 - CVE-2024-43800 serve-static: Improper Sanitization in serve-static
• BZ - 2311171 - CVE-2024-45590 body-parser: Denial of Service Vulnerability in body-parser
• BZ - 2311468 - [OCS Operator] Add isDROptimized feature to odf-info
• BZ - 2311551 - MCG Standalone fresh install and upgrades are broken
• BZ - 2311790 - [RDR] CephFS Consistency Group: Applications not getting DR protected
• BZ - 2311867 - [RDR] When installing Storagecluster we should readd Prepare cluster for disaster recovery (Regional-DR only) page
• BZ - 2311885 - rbd: disabling mirroring should fail if the the image is not in mirror disabled state
• BZ - 2311893 - [RDR] Disable DR stuck when using drpolicy without flattening with for a cloned/snapshot pvc based workload
• BZ - 2312137 - [RDR] When creating drpolicy UI should check for bluestore-rdr osd
• BZ - 2312442 - Provider mode deployment currently allows using external RHCS
• BZ - 2313178 - NSFS Copy Object (Server Side Copy) creates an object with corrupted content
• BZ - 2313203 - After deleting the pods and PVCs on a 4.16 hosted cluster the associated PVs stuck in a Terminating state instead of being deleted
• BZ - 2313515 - After upgrade to 4.17 there are two ocs-metrics-exporter where one is in 2/3 Running, reason: OOMKilled
• BZ - 2313717 - [ISF 2.8.1] [FDF 4.16.1] Name change for DF Client in OCP Operator Hub for Fusion Usecase
• BZ - 2313736 - [Provider] Rook deploys provisioner and plugin pods after deleting rook-ceph-operator pod when ROOK_CSI_DISABLE_DRIVER is True
• BZ - 2314200 - Default CephFS and RBD storageclaims are not created in provider and client clusters
• BZ - 2314211 - mcg-operator is installed with ocs-client-operator and it is in failed state
• BZ - 2314404 - [csi-addons] csi-addons operator pod goes into CLBO state
• BZ - 2314454 - [Provider Mode]Error "node Client not found for "hcp417-bm3-aaa-vvgph-sb6fz" nodeID" in ReclaimSpace Job
• BZ - 2314636 - MCG Standalone upgrade is broken
• BZ - 2315624 - [RDR] Mon doesn't come up and serviceexport is not created after enabling multiclusterservice
• BZ - 2315651 - [Provider Mode] Some pods under openshift-storage namespace does not contain 'node.ocs.openshift.io/storage' toleration
• BZ - 2315666 - [Stretch cluster] Network Fence for non-graceful node shutdown taint blocked volume mount on surviving zone
• BZ - 2315709 - include ibm odf-operator 1.6.0
• BZ - 2315733 - No permissions on the csi logs in csi-cephfsplugin-provisioner csi logs folder
• BZ - 2315846 - Set volsync support for discovered apps to off by default
• BZ - 2318490 - Backingstores can not be deleted on Provider
• BZ - 2319102 - [RDR] After testing Brownfield scenario for osd migration cephcluster is reporting ReconcileFailed error
• BZ - 2319238 - ceph-csi-operator-bundle does not satisfy icon requirements

CVEs

• CVE-2023-26136
• CVE-2023-26364
• CVE-2024-24786
• CVE-2024-24789
• CVE-2024-28176
• CVE-2024-41818
• CVE-2024-43788
• CVE-2024-43796
• CVE-2024-43799
• CVE-2024-43800
• CVE-2024-45296
• CVE-2024-45590

References

• https://access.redhat.com/security/updates/classification/#important