RHSA-2025:9775 - Security Advisory

Topic

A new image for Red Hat Ceph Storage 8.1 is now available in the Red Hat
Ecosystem Catalog.

Description

Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable version of the Ceph storage system with a Ceph management platform, deployment utilities, and support services.

These new packages include numerous enhancements, security and bug fixes, and known issues. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Ceph Storage Release Notes for information on the most significant of these changes:

https://docs.redhat.com/en/documentation/red_hat_ceph_storage/8/html/8.1_release_notes

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

For supported configurations, refer to:

https://access.redhat.com/articles/1548993

Affected Products

• Red Hat Enterprise Linux for x86_64 9 x86_64
• Red Hat Enterprise Linux for IBM z Systems 9 s390x
• Red Hat Enterprise Linux for Power, little endian 9 ppc64le

Fixes

• BZ - 2006083 - [Workload-DFG] [RFE] cephadm should create/configure RGW pools
• BZ - 2016889 - [RFE] [RADOS - Stretch Cluster] Integrate Stretch mode handling into cephadm
• BZ - 2047153 - [cephadm] orch upgrade status returns in same format for all different values of --format
• BZ - 2089305 - [RFE] Consistency group support in RBD mirror (snapshot mode)
• BZ - 2097853 - [RFE] : ceph orch upgrade status - Display easily understandable message instead of null, unknown, flase
• BZ - 2110983 - [orchestrator] : orch host drain : attempt to drain non existing host must fail
• BZ - 2121519 - RGW: set chunk size to stripe size if larger than stripe size
• BZ - 2124175 - [Cephadm] [RFE] [OS Tunning Profiles] Modifying Profiles commands not support multiple setting parameter changes.
• BZ - 2129325 - [ceph-dashboard][rfe][5.3]: Display bucket's number of shards on the ceph dashboard.
• BZ - 2134003 - [RFE] Provide orch commands to upgrade the monitoring daemons in RHCS
• BZ - 2135354 - [RFE][RGW][Include the ability to decrease the number of shards using the DBR feature]
• BZ - 2146728 - [RFE] RBD mirror daemon health metric
• BZ - 2170242 - CVE-2023-25577 python-werkzeug: high resource usage when parsing multipart form data with many fields
• BZ - 2170243 - CVE-2023-23934 python-werkzeug: cookie prefixed with = can shadow unprefixed cookie
• BZ - 2180089 - CVE-2022-23491 python-certifi: untrusted root certificates
• BZ - 2186791 - [Ceph-Dashboard] RFE: Need option to configure cloud transition from Object Gateway
• BZ - 2215374 - CVE-2023-46159 ceph: RGW crash upon misconfigured CORS rule
• BZ - 2237854 - [rgw][sts]: assume_role_with_web_identity call is failing as validation of signature is failing with invalid padding
• BZ - 2238814 - [RFE][RGW][Notifications]: support cross tenant topic management to allow put bucket notifications from other tenant users
• BZ - 2241321 - [RFE] Allow the modification of zone/zonegroup parameters through the RGW service spec file
• BZ - 2242261 - STS/OIDC. RGW Validation of a token signature may use a wrong OIDC certificate
• BZ - 2246310 - CVE-2023-46136 python-werkzeug: high resource consumption leading to denial of service
• BZ - 2250826 - [GSS]Graphs in Grafana Dashboard are not showing consistent line graphs after upgrading from RHCS 4 to 5.
• BZ - 2251887 - [RFE] Support adding existing data and metadata pool while creating FS volume
• BZ - 2253832 - [cephadm] cephadm takes osd service name as osd which doesn't have any spec file also service not got created
• BZ - 2265371 - [RHCS 8.1] [Workload-DFG] pg stuck in backfill / recovery (bug 2212945)
• BZ - 2268017 - CVE-2023-45290 golang: net/http: golang: mime/multipart: golang: net/textproto: memory exhaustion in Request.ParseMultipartForm
• BZ - 2268019 - CVE-2024-24783 golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm
• BZ - 2268021 - CVE-2024-24784 golang: net/mail: comments in display names are incorrectly handled
• BZ - 2268022 - CVE-2024-24785 golang: html/template: errors returned from MarshalJSON methods may break template escaping
• BZ - 2268046 - CVE-2024-24786 golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON
• BZ - 2269003 - [cee/sd][cephadm][RFE] CEPHADM_STRAY_DAEMON warning while replacing the osd
• BZ - 2274719 - Add support for 'only_bind_port_on_networks' spec parameter for alertmanager
• BZ - 2275856 - [RGW Multisite][Sync Fairness]: Bucket sync stuck on periodic start and stop of certain RGW daemons
• BZ - 2277697 - Warning message not appearing if crush failure domain is host
• BZ - 2279578 - cephadm logrotate.d entry insufficient
• BZ - 2279814 - CVE-2024-24788 golang: net: malformed DNS message can cause infinite loop
• BZ - 2282092 - When using rgw_dns_name config, the RGW dashboard section stops working.
• BZ - 2282276 - Instead of being displayed for k+m, a pop-up error message should have been presented for k+m+1.
• BZ - 2282369 - [RFE][RGW-Multisite]Update radosgw-admin help for --shard-id with optional for "sync error trim"
• BZ - 2282997 - [RFE] When configuring the RGW Multisite endpoints from the UI allow FQDN(Not only IP)
• BZ - 2291163 - On the scale cluster, rm -rf on the NFS mount point is stuck indefinitely when cluster is filled around 90% <eom>
• BZ - 2292251 - [rgw-ms][LC][Scale deletion]: LC policy is stuck in "PROCESSING" for a bucket 'syncfair4', resulting in deleted objects listed in the bucket list
• BZ - 2292668 - CVE-2024-24789 golang: archive/zip: Incorrect handling of certain ZIP files
• BZ - 2292787 - CVE-2024-24790 golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses
• BZ - 2293659 - Ceph version lacks minor version
• BZ - 2293847 - [8.1] [Read Balancer] pg_upmap_primary items are retained in OSD map for a pool which is already deleted
• BZ - 2294000 - CVE-2024-6104 go-retryablehttp: url might write sensitive information to log file
• BZ - 2294691 - [RGW-Multisite] Few data and metadata failed to replicate to other zones in 3-way multisite + archive cluster
• BZ - 2295310 - CVE-2024-24791 net/http: Denial of service due to improper 100-continue handling in net/http
• BZ - 2297166 - setfattr -x option is not working for ceph.quota.maxfiles
• BZ - 2298532 - CVE-2024-41184 keepalived: Integer overflow vulnerability in vrrp_ipsets_handler
• BZ - 2299776 - [8.1] [Read Balancer] {rm-,}pg-upmap-primary should require the feature support also from mons and osds
• BZ - 2299777 - [8.1] [Read Balancer] Decoders of OSDMap use old version for comparison of with struct_compat of DECODE_START
• BZ - 2301434 - [RHCS 8.0][NFS-Ganesha] Fallocate is allocating more space for file then actual disk size
• BZ - 2303640 - [cephfs][cephfs-journal-tool] cephfs-journal-tool import from invalid file throws unexpected exception
• BZ - 2304314 - ceph orch <start/stop/restart> does not work for OSDs when deployment name is "osd"
• BZ - 2304317 - add tpm2 token enrollment support to ceph-volume
• BZ - 2305658 - [RFE][Dashboard]: Add support for other KMS other than Vault under the Configuration section of the Dashboard
• BZ - 2307146 - [IBM Support] RGW ListObjectV2 p90 latency experienced during scrubbing
• BZ - 2308344 - [RFE] Intel QAT Acceleration for Haproxy(Ingress service) for encryption hardware offloading
• BZ - 2308641 - [ceph-dashboard][rgw] Edit button is not enabled for some of the ceph configs
• BZ - 2308647 - [CephFS][NFS] NFS daemon fails during mount, error in messages 'status=2/INVALIDARGUMENT'
• BZ - 2308662 - RFE[ceph-dashboard]when navigated to Administration >> Configuration, would like to see configuration modified
• BZ - 2309701 - [s3-cloud-restore]: s3-restore-object does not sync over a multisite
• BZ - 2310433 - ISA-L plugins (libec_isa.so and libceph_crypto_isal.so) don't include AVX512 acceleration
• BZ - 2310527 - CVE-2024-34155 go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a panic/stack exhaustion
• BZ - 2310528 - CVE-2024-34156 encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion
• BZ - 2312578 - [rgw]:segafult (Floating point exception) in radosgw-admin thread, on executing bucket object shard with num_shards 0
• BZ - 2312931 - [s3-cloud-restore]: Fix restoration of non-current objects
• BZ - 2313279 - [RFE]: Post deleting services like grafana, prometheus related entries must be automatically removed from manager module-> dashboard
• BZ - 2313407 - [NFS-Ganesha] [Dashboard] When creating an NFS export from a subvolume in the dashboard, a warning message appears stating "500 - Internal Server Error: 'NoneType' object is not subscriptable."
• BZ - 2313513 - Inconsistent click trigger for dashboard notifications panel icon
• BZ - 2314422 - [RFE] "Ports" information of the services deployed should be shown in dashboard Administration >> Services
• BZ - 2314626 - s3keys section in user edit page looks disoriented , missing key icon
• BZ - 2314627 - space between checkbox and text is missing in object --> user create/edit and object --> bucket edit page
• BZ - 2314716 - [RFE] rgw_dns_name and rgw_dns_s3website_name not updatable via Ceph Restful API
• BZ - 2314855 - [RFE]: Provide a support for automatic restart post creation of default realm/zone group/zone as a part of multisite migrate
• BZ - 2314858 - [RFE]: Automate the process of replication user creation during single site to multisite migration
• BZ - 2314995 - Deleted object still present in bucket listing
• BZ - 2315072 - Deploying prometheus service for the first time, will not update PROMETHEUS_API_HOST url under manager module.
• BZ - 2315401 - Update the default device class during creation of new CRUSH rule for replicated pools via dashboard
• BZ - 2315602 - [RFE][rgw][dashboard][lc-transition]: LC rules are not shown in the dashboard for buckets owned by RGW accounts
• BZ - 2315603 - Data under User management --> Roles section is not aligned with column name
• BZ - 2316488 - CVE-2024-47191 oath-toolkit: Local root exploit in a PAM module
• BZ - 2316598 - [RFE] RGW User Keys creation date info
• BZ - 2316975 - s3 with keystone ec2 auth fails when rgw_s3_auth_order puts local before external
• BZ - 2317153 - [RGW-Multisite] Slow sync observed in bucket stats of dynamically resharded bucket
• BZ - 2317528 - [RFE] Support adding multiple labels to a ceph host in one command
• BZ - 2317735 - RFE: extend snapdiff API to enable only transferring changed portions of a file
• BZ - 2317777 - Complete description text is not visible when we click on info icon for ACL in bucket create/edit page
• BZ - 2317785 - Info panel is broken under multiple section
• BZ - 2317969 - [rfe][replication-header]: ReplicationStatus shows as 'PENDING' even when the object has synced to the other zone.
• BZ - 2319125 - rgw_servers filtering not respected in RGW Overview garfana graphs
• BZ - 2319199 - [GSS] radosgw-admin lc process --bucket <bucket> doesn't remove objects if versioning is suspended
• BZ - 2319356 - [RFE][Cephadm] ceph cli command to check default set images
• BZ - 2320860 - Ceph conmon [DBG] logs flood /var/log/messages causing filesystem to fill up
• BZ - 2321108 - [NFS-Ganesha] [V3] Enable_UDP = false;" is missing in the ganesha.conf file
• BZ - 2321568 - [8.0][rgw] put-bucket-logging on a bucket with TargetBucket pointing to itself in the policy is not denied
• BZ - 2321765 - Ceph Exporter: Does not manage Linux signals SIGINT/SIGTERM
• BZ - 2322398 - Remove statement about multi-cluster setup from helper text under Set up Multi-site Replication section in RH dashboard
• BZ - 2322664 - [RFE][rgw]: add support for removing cliendID from an OIDC provider
• BZ - 2322677 - [dashboard INFO exception] Dashboard Exception: Unable to retrieve the gateway info: string indices must be integers
• BZ - 2323290 - CVE-2023-46159 ceph: RGW crash upon misconfigured CORS rule resulting in denial of service [ceph-8]
• BZ - 2323601 - [RFE][cephadm][rgw] please include ceph fsid in the cephadm-root ca certificate
• BZ - 2323836 - RFE: Support enabling/setting bucket level rate limit from dashboard
• BZ - 2323837 - RFE: Support enabling/setting user level rate limit from user page via dashboard
• BZ - 2324227 - [7.1][rgw][sts] with incorrect thumbprints in the OIDC provider, sts aswi request is successful bypassing thumbprint verification
• BZ - 2325383 - [ceph-volume] fails to zap partitioned disk
• BZ - 2325397 - Namespace creation with Kb size is not supported
• BZ - 2325408 - [RGW] HEAD on bucket shall not traverse all bucket index shards
• BZ - 2326425 - [RFE] Unable to exit from maintenance mode when a ceph host goes down.
• BZ - 2327267 - [RFE] Mirroring to Support Default namespace to non-default namespace and vice versa
• BZ - 2327311 - Request the ability to trash images via namespace deletion in the API
• BZ - 2327402 - User metadata replicated from a pre-8.0 zone defaults to inactive access keys
• BZ - 2327774 - [8.0][rgw][kafka-ssl][multipart]: after disabling notification_v2, intermittent rgw crash with complete-multipart-upload on notification configured bucket with kafka-ssl
• BZ - 2328008 - [CephFS-MDS][system-test] MDS failover and FS Volume remove returns EPERM error stating MDS_TRIM or MDS_CACHE_OVERSIZED but no mds trimming issue on corresponding mds
• BZ - 2329523 - [rgw][listing]: list-object-versions fails on versioned bucket, with error marker failed to make forward progress
• BZ - 2330146 - [NFS-Ganesha] ceph nfs cluster info Does Not Display --ingress_mode Configuration
• BZ - 2330769 - [RBD] CLI - RBD group image add failing with optional arguments
• BZ - 2330898 - Ingress Service not working when using virtual_ips_list option
• BZ - 2330954 - Cephadm feature to create self signed certificates for RGW is not adding a SAN for *.example.com on the created Certificate
• BZ - 2331411 - [rfe] ceph orch ls does not display comma-separated Ports for RGW service
• BZ - 2331703 - [cephadm][single-node]: nfs service stuck in deleting state leading to cluster error state.
• BZ - 2331781 - cephadm generates nfs-ganesha config with incorrect server_scope value
• BZ - 2331790 - nfs-ganesha 4.1+ server does not process reclaim_complete correctly after moving to another node
• BZ - 2332349 - Need supported nfs-ganesha recovery backend for HA-NFS planned and unplanned failover
• BZ - 2335768 - [GSS] TypeError in Ceph Dashboard when accessing /api/osd/settings after upgrade to Ceph 7 (18.2.0-192.el9cp)
• BZ - 2336352 - watcher remains after "rados watch" is interrupted
• BZ - 2336503 - [10k osd] ceph-exporter on osd nodes not providing data to prometheus
• BZ - 2336863 - When the cephadm agent is deployed, the 4721/tcp port is not opened (firewalld)
• BZ - 2336885 - [GSS] [Ceph Tracker #53240] Full-object read crc is mismatch, because truncate modify oi.size and forget to clear data_digest.
• BZ - 2338097 - [GSS] multiple OSDs crashing while replaying bluefs -- ceph_assert(delta.offset == fnode.allocated)
• BZ - 2338119 - setting rgw_lc_max_worker > 10 cause rgw crash
• BZ - 2338126 - [NFS-Ganesha] On the freshly installed NFS cluster, configuration error warnings were observed in the ganesha.log file
• BZ - 2338149 - Unable to grant group permission (ACL) for buckets
• BZ - 2338402 - Getting ERROR: failed to decode olh info while performing radosgw-admin olh get
• BZ - 2338406 - [NFS-Ganesha] Ganesha crashed during a failover operation, with the ingress mode configured as haproxy-protocol.
• BZ - 2339092 - RBD migration execute reports incorrect status when NBD export on the source is disconnected
• BZ - 2341711 - rgw: bucket logging fixes and enhancements
• BZ - 2341761 - [GSS] How to remove listed indexes of objects where the object has been deleted by LC or AZ
• BZ - 2342208 - [Ceph-Dashboard] hide iSCSI page in 8.0 clusters and show a warn message when enabling it
• BZ - 2342244 - Snapshots doesn't work when the caps for implicit namespace is set
• BZ - 2342747 - [RGW]: Daemon crash observed on a put object with a LDAP authenticated user
• BZ - 2342752 - After performing the osd resize test the osd pods failed to recover and the cluster ceph health was not OK
• BZ - 2342827 - [8.1] Allow decoding of v1-v3 of RGWZoneGroupPlacementTier
• BZ - 2342909 - [10k osd] Deploying OSDs that have container_args defined forces redeployment and restarts
• BZ - 2342928 - Unable to Delete Objects when RADOS Pool quota hits Max
• BZ - 2343149 - nfs_mgr : nodeid should be numeric for RADOS_KV block in ganesha.conf file
• BZ - 2343732 - RGW: swift API container list doesn't include last_modified
• BZ - 2343918 - cephfs_mirror: incremental sync results in unidentical snapshots
• BZ - 2343953 - cephfs_mirror: incremental sync fails switching to remote dir_root
• BZ - 2343968 - tools/cephfs/DataScan: test and handle multiple duplicate injected primary links to a directory
• BZ - 2343980 - [rgw][notif][kafka-cluster]: rgw crashed at complete multipart while sending notification to the partitioned topic
• BZ - 2344191 - [10k osd] ceph-dashboard throwing "Http failure during parsing for https://ip:8443/api/pool?stats=true" error
• BZ - 2344352 - [RFE] SSL Certificate update taken affect in Ceph service update request
• BZ - 2344731 - rgw/cloud-restore: Do not send internal RGW headers to cloud-endpoint
• BZ - 2344746 - [NFS-Ganesha] NFS ganesha deployment is failing with NFS v6.5-1.5 "Error while parsing RadosKV
• BZ - 2344993 - [rgw][server-access-logging]: radosgw-admin bucket logging flush command is returning next log object name instead of current log object name
• BZ - 2345193 - rook-ceph-nfs pod is in CrashLoopBackOff state after enabling nfs.
• BZ - 2345267 - [GSS] Ceph API returns empty ceph version field on api/host request
• BZ - 2345288 - ceph.quota.max_bytes accepting Values like TG, GT, KT
• BZ - 2345305 - [rgw][server-access-logging][RFE]: add support for configuring permission for a bucket to be used as a target bucket for log object delivery
• BZ - 2345486 - [RFE][s3-cloud-restore]: Support cloud-restore feature for Glacier/Tape endpoints.
• BZ - 2345488 - [RFE][s3-cloud-restore]: Add an option to configure storage-class for restore
• BZ - 2345489 - [RFE] Cephadm. Add options to configure ingress with re-encrypt options
• BZ - 2345721 - Wrong "stopped" mirroringStatus summary in radosnamespace
• BZ - 2346615 - mds crash during import of tree during quiesce
• BZ - 2346769 - Support N+E Signature Checking in AssumeRoleWithWebIdentity
• BZ - 2346829 - STS Federated Users Shadow User UID is missing "oidc$"
• BZ - 2346896 - [8.1z] [10k osd][RGW] rgw daemon segmetation fault _pg_to_raw_osds
• BZ - 2348395 - [RFE][RGW][kafka] add support for multiple brokers
• BZ - 2348670 - [NFS-Ganesha][Ceph-Mgr] Correct the min and max supported values for bandwidth and iops limits in rate limiting
• BZ - 2349010 - FFU upgrade from 16.2.6 to 17.1.4 - Missing metrics for individual RBD images
• BZ - 2349077 - [8.x] [Read Balancer] Make rm-pg-upmap-primary able to remove mappings by force
• BZ - 2350069 - [RFE] [NFS-Ganesha] [QoS] Disabling the cluster level QoS still reflects the QoS related setting on Export config file.
• BZ - 2350186 - [RFE] Case-insensitive directory trees
• BZ - 2350214 - High fragmentation in BlueStore should generate health warning in a cluster
• BZ - 2350227 - [8.1][Cephadm-Anisble][Ceph Pre-Installation Checks Enhancements] Feature Not Available in Latest Build
• BZ - 2350260 - [Ceph-Dashboard] Upgrade angular to 18
• BZ - 2350291 - [ceph-dashboard] Storage class management
• BZ - 2350295 - [ceph-dashboard] Confirmation textbox on deleting critical resources
• BZ - 2350416 - [RFE] diff-iterate should allow passing the "from snapshot" by snap ID
• BZ - 2350472 - [RFE] open images in read-only mode for "rbd mirror pool status --verbose"
• BZ - 2350551 - [ceph-dashboard]: RGW Ratelimit for User and Bucket
• BZ - 2350578 - fix possible recursive lock of ImageReplayer::m_lock
• BZ - 2350580 - fix a crash on a non-mirror snapshot in get_rollback_snap_id()
• BZ - 2350592 - fix a deadlock on image_lock caused by Mirror::image_disable()
• BZ - 2350607 - [RGW] RGW Crash During Object Deletion
• BZ - 2351028 - [Ceph-Dashboard] hardware status summary
• BZ - 2351048 - [ceph-dashboard] GKLM in SSE-KMS
• BZ - 2351099 - [Ceph-Dashboard] Carbonize RGW User and Buckets Form
• BZ - 2351161 - [RFE]Cephadm. RGW concentrators
• BZ - 2351180 - cephadm: patches for IBM cloud
• BZ - 2351287 - [RFE] Cephadm. Introducing Certmgr[TP]. MVP. Check for Certificate expiration and warn in Ceph status
• BZ - 2351292 - [8.1] [Add-host] [Mix OS] While adding RHEL 8 host to the RHEL 9 admin node it fails with error "No module named 'dataclasses'"
• BZ - 2351461 - [NFS-Ganesha] [QoS] For dashboard API, NFS qos get funtion should return bandwidths in bytes
• BZ - 2351536 - Add support for IBM Security Verify to the dashboard oauth_proxy SSO configuration
• BZ - 2351558 - [NFS-Ganesha] NFS-Ganesha cluster deployment is failing with 8.1 builds
• BZ - 2351790 - [8.1][Cephadm-Ansible][Ceph Pre-Installation Checks][cephadm-preflight.yml] Playbook Fails at "Store All Preflight Check Results"
• BZ - 2351836 - [8.1] Bootstrap fails with ERROR: Failed to set orch backend to cephadm: maximum retries reached
• BZ - 2351842 - [RGW] Buckets are not getting resharded as expected with rgw_dynamic_resharding set to true
• BZ - 2351846 - [RGW-Dashboard]: Unable to view user key detail
• BZ - 2351868 - [RGW-Dashboard]: Not able to edit user display/full name via UI
• BZ - 2352427 - [8.1][RGW] RGW crashes when performing multipart upload using aws-cli/2.24.22
• BZ - 2352499 - [Ceph-Dashboard] broken dashboard user access control perm issues
• BZ - 2352525 - Mgr daemon crashed in "mgr_module": "cephadm" during Upgrade from 8.0 GA to 8.1 nightly builds
• BZ - 2352534 - [RGW]: Info message on a successful reshard shows wrong "from" value
• BZ - 2352585 - [NFS-Ganesha] CONFIG :WARN :Syntax error in statement at line 17 of /etc/ganesha/ganesha.conf for Server_Scope = 4da66c06-fd28-11ef-8341-fa163e07d392-nfsganesha
• BZ - 2352840 - [Ceph-Dashboard] Convert the host form to use carbon design system
• BZ - 2352898 - [RGW-Dashboard]: Object NFS page is broken
• BZ - 2353013 - Cephadm: Staggered upgrades by topological labels
• BZ - 2353171 - [ceph-dashboard] NFS Cluster and Export Listing
• BZ - 2353172 - [NFS-Ganesha] Unable to modify the export block post disabling the QoS at cluster level
• BZ - 2353305 - [RGW-Dashboard]: Unable to scroll down option entries in OSD page
• BZ - 2354000 - mgr/dashboard: RGW Multi-site wizard not showing up
• BZ - 2354043 - radosgw crashes with 'std::bad_alloc' while deleting object from version suspended bucket
• BZ - 2354192 - [GSS] bluefs mount failed to replay log: (5) Input/output error.
• BZ - 2354475 - [8.1] cephadm rm-cluster fails to cleanup disks
• BZ - 2354498 - GroupUnlinkPeerRequest: handle_remove_group_snapshot: failed to remove image snapshot metadata: (30) Read-only file system
• BZ - 2354499 - Deadlock to recover from consistency group with images from multiple pools
• BZ - 2354501 - [Usability]: Removing mirror group snapshot schedule with group-spec should throw error
• BZ - 2354529 - [ceph-dashboard][rgw] bucket details section > Tiering form not supporting editing lifecycle rule Tag data
• BZ - 2354788 - NFS commands updating export should have parameter to skip notify to nfs server
• BZ - 2354858 - [rgw][dashboard]: tenanted bucket lifecycle rules not shown in Bucket details > Tiering list page
• BZ - 2354885 - client: ll_walk will process absolute paths as relative
• BZ - 2354903 - ceph-mgr stops responding to status tell commands which confuses rook
• BZ - 2354911 - [8.1][rgw]: post upgrade from 8.0 to 8.1, rgw crashing with old versioned objects download using aws-cli/2.24.22
• BZ - 2355272 - [rgw][topic]: on an upgraded environment from 7.1 to 8.0, radosgw-admin topic list outputs with added key "result"
• BZ - 2355303 - Provide flags to configure unicode normalization and case sensitivity during subvolume creation
• BZ - 2355344 - NFS QoS - log and expection messages should use word QoS not QOS
• BZ - 2355683 - mgr/dashboard: Encryption checkbox not getting enabled on bucket form even if encryption config is set
• BZ - 2355686 - mgr/vol: allow passing pools to "fs volume create" cmd
• BZ - 2355691 - Prevent hangs and delays when the libcephfs proxy is used
• BZ - 2355694 - [RGW-Dashboard]:Getting 500-Internal Server error, while creating bucket tiering rule from dashboard
• BZ - 2355703 - [ceph-dashboard] NFS Rate Limit for enabling disabling QOS for Cluster and Export
• BZ - 2356355 - Implement only_bind_port_on_networks for RGW
• BZ - 2356515 - [8.1.? backport] osd/scrub: discard repair_oinfo_oid()
• BZ - 2356526 - `ceph-bluestore-tool show-label` fails with multiple devices if at least one of them doesn't have a valid label
• BZ - 2356552 - [Usability]: Correct Typo in MAN Pages for group mirroring
• BZ - 2356678 - rgw: tail objects are wrongly deleted in copy_object
• BZ - 2356802 - [8.1][RGW][Dashboard]: 500 Internal Server Error for buckets Having LC policies set
• BZ - 2356850 - [RFE] Add High availability support for the Ceph mgmt-gateway
• BZ - 2356922 - Consistent, reproducible RGW crashes in special awscli upload-part-copy scenario
• BZ - 2356923 - libcephfs: provide mechanism to get perf counters via API
• BZ - 2357127 - Renamed group reverts to old name in group mirroring
• BZ - 2357179 - cross namespace mirror group enters into split-brain on a normal relocate operation
• BZ - 2357422 - Adding/removing/listing mirror group snapshot schedule should be blocked when group mirroring is disabled
• BZ - 2357450 - mirror group promote failing when "demotion is not propagated yet"
• BZ - 2357461 - Bootstrap failed on secondary cluster on disabling group mirroring on primary
• BZ - 2357464 - [RFE] Initial set of fields for "rbd mirror group status" description string in up+replaying state
• BZ - 2357488 - libcephfsd logs appears to be empty due to libc buffering
• BZ - 2358010 - Do not attempt to perform any undo on "rbd mirror group promote --force" failure
• BZ - 2358143 - [8.1][RGW] BucketAlreadyExists error expected with awscli for config rgw_bucket_eexist_override
• BZ - 2358304 - Both Fresh installation and Upgrade ( 8.0z3 --> 8.1) is failing with "PyO3 modules compiled for CPython 3.8 or older may only be initialized once per interpreter process"
• BZ - 2358435 - FSCrypt Encryption in Userspace
• BZ - 2358455 - [RGW-MS][s3-object-tag]: Object tags applied from secondary and deleted before sync are not replicated to primary if re-applied from secondary
• BZ - 2358617 - [s3-cloud-restore]: Support cloud-restore feature for Glacier/Tape endpoints with Standard retrieval tier type
• BZ - 2358641 - [Ceph-Dashboard] 500 Internal Server Error - On Setting RGW Rate limit on Bucket and Verifying the changes
• BZ - 2358769 - The rbd-mirror daemon crashes when running rbd_mirror_group_simple.sh
• BZ - 2358806 - [RGW][Dashboard]: Retain head object option selection is not respected while creating storage class tiering from UI
• BZ - 2358807 - While editing tiering retain head object checkbox should be selected, if previously it was set as true either from CLI/UI
• BZ - 2358816 - [RH-Dashboard]: Include release along with upper header in about panel
• BZ - 2358825 - Modify Bandwidth and IOPS limits for QoS commands
• BZ - 2359017 - [ceph-dashboard] RGW - Assigning correct secret key to teiring configuration
• BZ - 2359056 - GroupReplayer and group_replayer::BootstrapRequest require changes
• BZ - 2359057 - [RGW][8.1]: Downsharding not observed on regular bucket using custom rgw_max_objs_per_shard
• BZ - 2359062 - GroupReplayer::restart() can cause a hang in InstanceReplayer::stop()
• BZ - 2359194 - [NFS-Ganesha] [Dashboard][QoS] Mismatch in bandwidth values: 3?GB set via Dashboard is shown as 3.2?GB in CLI
• BZ - 2359508 - [NFS-Ganesha] The NFS Ganesha daemon crashed at lookup_path while updating the ops limit, with a lookup operation running in parallel.
• BZ - 2359515 - Request Ganesha to support binding to specific address for monitoring
• BZ - 2359556 - Pool name field is empty on updating the namespace
• BZ - 2359598 - [CephFS - FScrypt] Read-Write in locked mode returns "Input/output error" but error similar to "Required key not available" is expected
• BZ - 2359678 - [Dashboard] Modify Bandwidth and IOPS limits for QoS commands
• BZ - 2359716 - Performing rgw realm bootstrap for the first time throws an AttributeError: 'NoneType' object has no attribute 'get_key'
• BZ - 2359798 - Unexpected Deletion of existing pools upon failed "ceph fs volume create" command with Non-Existing Pools
• BZ - 2360152 - [RGW-MS] sync fairness can induce replication stalls in specific circumstances
• BZ - 2360666 - [8.1][rgw][server-access-logging]: radosgw-admin bucket logging flush command is failing if the logging policy contains a tenanted bucket as TargetBucket
• BZ - 2361465 - up+error with "bootstrap failed" is reported transiently when a group is renamed
• BZ - 2361701 - [Scale] Consistency group mirroring promote failing with "group group_1 is still primary within a remote cluster"
• BZ - 2361737 - Disallow "rbd trash mv" if image is in a group
• BZ - 2361747 - [Scale] Mirror group operation failed with : librbd::mirror::GroupGetInfoRequest: 0x5560070f3690 handle_get_last_mirror_snapshot_state: failed to list group snapshots of group 'group_29': (22) Invalid argument
• BZ - 2361817 - [8.1][cloud-s3-glacier] First restore request of an object with tier type 'cloud-s3-glacier' fails with 'argument of type 'NoneType' is not iterable'
• BZ - 2361828 - [8.1][Cephadm-Ansible][cephadm-preflight.yml] Playbook fails at [Ensure reports directory exists on the Ansible controller]
• BZ - 2361872 - [s3-cloud-restore]: s3 copy fails for a cloud restored object
• BZ - 2362278 - [CephFS - FScrypt] File not retrieved after unlock when filename was 256bytes long
• BZ - 2362289 - [NFS-Ganesha] Ganesha process crashed at __memcpy_evex_unaligned_erms while running the pynfs test suite vers=4.1
• BZ - 2362859 - [CephFS - FScrypt] Snapshot directory .snap has junk/non-readable chars in unlocked mode after snapshot data copy op
• BZ - 2362899 - Resurrect behavior where ENOENT error in Mirror::group_get_info() is suppressed
• BZ - 2363085 - [RGW]: S3 Restore status stuck at ongoing-request="true" for a particular object my-new-file2m
• BZ - 2363086 - [rgw-ssl][8.1][sts]: with an rgw ssl endpoint, assume-role request is failing with "ERROR: Invalid rgw sts key", but working fine with non-ssl rgw endpoint
• BZ - 2363635 - ceph fs commands failing , ceph health reporting "Module 'volumes' has failed dependency: invalid syntax (module.py, line 150)"
• BZ - 2364290 - [rgw-S3-restore]: RGW segfaulted in thread_name 'http_manager' while restoring a 975M object from aws cloud using Standard retrieval
• BZ - 2364715 - cephfs-mirror: memleak in sync code path
• BZ - 2365098 - [RBD-Mirror] Snapshot-based mirroring from Ceph 8.1 primary to 7.1 secondary results in WARNING state
• BZ - 2365146 - [rgw][s3select]: radosgw process killed with "Out of memory" while executing query "select * from s3object limit 1" on a 12GB parquet file
• BZ - 2365154 - Input/Output error using fio against CephFS backed NFS mount
• BZ - 2365869 - NFS ganesha server cluster crashing while running perf benchmarking via spec storage
• BZ - 2365926 - [cephadm][rgw-ssl]: "ceph orch ps --refresh" is triggering a daemon reconfig multiple times
• BZ - 2366187 - URL updates needed
• BZ - 2366823 - group info should verify snapshot completion before marking the group as primary
• BZ - 2367319 - [rgw][cksum] failure to compute/verify checksums with recent aws-go-sdk-v2 versions
• BZ - 2367419 - nfs-ganesha rebuild breaks after important libcephfs API change is merged
• BZ - 2367433 - [s3-restore][rgw] s3:restore_obj Fails on 2GB object with Truncation Error
• BZ - 2367444 - Need to update QOS minimum BandWidth value
• BZ - 2367723 - [NFS-Ganesha] Running some of the commands (dd and git clone) on an NFS mount point results in an "Input/output error".
• BZ - 2368271 - "Module 'cephadm' has failed: grace tool failed: Failure - during upgrade
• BZ - 2368715 - [8.1][oauth2-proxy] monitoring stack services go down when oauth2-proxy service is deployed
• BZ - 2369125 - [NFS-Ganesha] NFS crashed (In function 'xlist<T>::item::~item() [with T = MetaRequest*]') while running cthon tests in loop with parallel lookups
• BZ - 2369127 - Upgrade is broken due to changed type of nodeid and ceph uuid logic
• BZ - 2369129 - Upgrade is broken due to changed type of nodeid and ceph uuid logic
• BZ - 2369786 - [8.1] prometheus fails with 404 error when mgr daemons are upgraded due to root-CA not in sync post upgrade
• BZ - 2369820 - [8.0z5] [NFS-Ganesha]NFS ganesha cluster creation is failing on the upgraded cluster from 7.x to 8.1
• BZ - 2370002 - [rgw][checksum]: with aws-go-sdk-v2, chunked object upload with trailing checksum of SHA1 or SHA256 is failing with 400 error
• BZ - 2372523 - Virtual server functionality is broken

CVEs

• CVE-2022-23491
• CVE-2023-23934
• CVE-2023-25577
• CVE-2023-46136
• CVE-2023-46159
• CVE-2024-41184
• CVE-2024-42353
• CVE-2024-47191

References

• https://access.redhat.com/security/updates/classification/#important