RHSA-2025:4238 - Security Advisory

Topic

An update is now available for Red Hat Ceph Storage 6.1.

Description

Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable version of the Ceph storage system with a Ceph management platform, deployment utilities, and support services.

These new packages include numerous security and bug fixes. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Ceph Storage Release Notes for information on the most significant of these changes:

https://docs.redhat.com/en/documentation/red_hat_ceph_storage/6/html/6.1_release_notes/index

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

For supported configurations, refer to:

https://access.redhat.com/articles/1548993

Affected Products

• Red Hat Enterprise Linux for x86_64 9 x86_64
• Red Hat Enterprise Linux for x86_64 8 x86_64
• Red Hat Enterprise Linux for IBM z Systems 9 s390x
• Red Hat Enterprise Linux for Power, little endian 9 ppc64le
• Red Hat Enterprise Linux for Power, little endian 8 ppc64le

Fixes

• BZ - 2164077 - Error message is not descriptive for ceph tell command
• BZ - 2246440 - cephadm trys to bind grafana daemon to all (::) interfaces when valid networks list is provided.
• BZ - 2247402 - [RHCS6][cee/sd][ceph-mon] ceph-mon does not handle gracefully wrong syntax of "ceph health mute" command
• BZ - 2257935 - 6.1z backport][GSS][Ceph Tracker #53240] Full-object read crc is mismatch, because truncate modify oi.size and forget to clear data_digest.
• BZ - 2266793 - Etag element has empty string for complete-multipart-upload output
• BZ - 2269342 - [6.1z backport] [rgw-multipart/encryption]: Object download fails with "MD5 signatures do not match" if transitioned to other storage class
• BZ - 2271596 - [devicehealth] legacy objects with snapshots cannot be loaded
• BZ - 2275475 - [cee/sd][mgr][progress WARNING root] complete: ev {UUID} does not exist
• BZ - 2283576 - [6.1z backport][GSS] Cache oversize warning gives 0 values for inodes in use by clients and stray files
• BZ - 2290721 - [RFE] - Include the "ceph orch set-unmanaged" command to disable automatic management of daemon
• BZ - 2297966 - [Backport bug:2249003] - Observing client.admin crash in thread_name 'rados' on executing 'rados clearomap.
• BZ - 2299482 - [Workload-DFG][mClock] Inconsistent client throughput during recovery with mClock balanced profile
• BZ - 2300252 - [cephfs][scrub][6.x] Assertions observed on standby-replay MDS nodes when executing the cephfs scrub command.
• BZ - 2303084 - Backport yes-i-really-mean-it flag for entering a host into maintenance mode
• BZ - 2303112 - [RHCS6 backport][RGW-MS][Versioning]: Deleting an object [with version-id null] from one site, does not delete the object from the other site.
• BZ - 2303415 - [RGW-Multisite] ERROR: Zone <zoneid> does not support feature "resharding" required by zonegroup
• BZ - 2307933 - [Ceph Upstream Tracker 63422]: librbd crash in journal discard wait_event [6.1z]
• BZ - 2308166 - [RHCS 6][Ceph-mgr][Thousands of connections in CLOSE-WAIT status]
• BZ - 2314213 - [6.1z backport] [CEE] Error 401 on some RGW servers
• BZ - 2315686 - Client eviction fails with "no hosts match"
• BZ - 2315936 - Missing --zap-osd-devices Flag option in Host Draining
• BZ - 2317530 - Different behavior in permissions handling for paths with trailing slashes between 7.1 and 8.0.
• BZ - 2317562 - [CephFS][MDS] MDS rank info mismatch between cli and json output for standby-replay MDS
• BZ - 2318288 - [6.1z backport] osd/TrackedOp: Fix TrackedOp event order
• BZ - 2321292 - [CEE] Multipart file download by anonymous user results in 401 error.
• BZ - 2326137 - mon: avoid exception when setting require-osd-release is set to more than 2 releases backwards
• BZ - 2337305 - client crash or interrupted flatten can result in a corrupted image after (possibly restarted) flatten [6.1z]
• BZ - 2337309 - live import from HTTPS or S3 gets interrupted by SSL session resets [6.1z]
• BZ - 2343973 - [6.1z backport] tools/cephfs/DataScan: test and handle multiple duplicate injected primary links to a directory
• BZ - 2345553 - [CephFS-Snap Schedule] : Snapshot rotation fails when mds_max_snaps_per_dir set to non-default value < 100
• BZ - 2345559 - [cephfs][cephfs-top] exception: addwstr() returned ERR
• BZ - 2345561 - [IBM Support][ODF][4.11] Active MDS stuck in up:clientreplay state
• BZ - 2355037 - [cee/sd][cephadm][RFE] CEPHADM_STRAY_DAEMON warning while replacing the osd
• BZ - 2357854 - [6.1z Backport][GSS] Ceph API returns empty ceph version field on api/host request

CVEs

• CVE-2024-47191
• CVE-2024-48916

References

• https://access.redhat.com/security/updates/classification/#important