Table of Contents
Red Hat OpenStack Platform 13 included some Ceph components at release for in order to support ppc64le. The version provided in the OpenStack repositories is outdated and customers are expected to be using versions provided in Ceph repositories now. Additionally, only the client side and libraries were included which are not affected by this vulnerability.
CVSS v3 metrics
|CVSS3 Base Score||7.5|
|CVSS3 Base Metrics||CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H|
Red Hat Security Errata
|Red Hat Ceph Storage 3 for Red Hat Enterprise Linux 7 (ceph)||RHSA-2019:2577||2019-08-28|
|Red Hat Ceph Storage 3 for Ubuntu||RHSA-2019:2579||2019-08-28|
Affected Packages State
|Red Hat OpenStack Platform 13.0 (Queens)||ceph||Not affected|
|Red Hat Enterprise Linux 8||ceph||Not affected|
|Red Hat Enterprise Linux 7||ceph-common||Not affected|
|Red Hat Ceph Storage 2||ceph||Not affected|
AcknowledgementsRed Hat would like to thank Abhishek Lekshmanan (SUSE Software Solutions Germany) for reporting this issue.
To mitigate this issue either of the following options can be applied to system:
1. By default system will use /etc/init.d/ceph-radosgw
stop this service by
~]# /etc/init.d/ceph-radosgw stop
2. Create systemd service, and change command line parameters according to the environment
where Ceph radosgw is running.
~]# cat /usr/lib/systemd/system/ceph-rgw.service
Description=Ceph RGW daemon
ExecStart=/bin/radosgw -n client.rgw.$(HOSTNAME REDACTED)
3. Run systemd service 'ceph-rgw.service'
Caveat: It still takes +1-2 sec to get service back online. After applying above mentioned mitigation, the malicious IP can be blocked by a firewall rule if there are continuous attempts to launch remote denial of service. This mitigation is of limited use if the attack is launched from multiple IPs. It is recommended to limit the exposure of ceph RGW server to known clients.
use 'civetweb' as HTTP frontend with ceph RGW.