Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2020.4215
Security update for ceph
30 November 2020
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: ceph
Publisher: SUSE
Operating System: SUSE
Impact/Access: Execute Arbitrary Code/Commands -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2020-25660
Reference: ESB-2020.4147
ESB-2020.4146
Original Bulletin:
https://www.suse.com/support/update/announcement/2020/suse-su-20203473-2
https://www.suse.com/support/update/announcement/2020/suse-su-20203539-1
Comment: This bulletin contains two (2) SUSE security advisories.
- --------------------------BEGIN INCLUDED TEXT--------------------
SUSE Security Update: Security update for ceph
______________________________________________________________________________
Announcement ID: SUSE-SU-2020:3473-2
Rating: moderate
References: #1163764 #1170200 #1170498 #1173079 #1174466 #1174529
#1174644 #1175120 #1175161 #1175169 #1176451 #1176499
#1176638 #1177078 #1177151 #1177319 #1177344 #1177450
#1177643 #1177676 #1177843 #1177933 #1178073 #1178531
Cross-References: CVE-2020-25660
Affected Products:
SUSE Enterprise Storage 7
______________________________________________________________________________
An update that solves one vulnerability, contains two features and has 23 fixes
is now available.
Description:
This update for ceph fixes the following issues:
o CVE-2020-25660: Bring back CEPHX_V2 authorizer challenges (bsc#1177843).
o Added --container-init feature (bsc#1177319, bsc#1163764)
o Made journald as the logdriver again (bsc#1177933)
o Fixes a condition check for copy_tree, copy_files, and move_files in
cephadm (bsc#1177676)
o Fixed a bug where device_health_metrics pool gets created even without any
OSDs in the cluster (bsc#1173079)
o Log cephadm output /var/log/ceph/cephadm.log (bsc#1174644)
o Fixed a bug where the orchestrator didn't come up anymore after the
deletion of OSDs (bsc#1176499)
o Fixed a bug where cephadm fails to deploy all OSDs and gets stuck (bsc#
1177450)
o python-common will no longer skip unavailable disks (bsc#1177151)
o Added snap-schedule module (jsc#SES-704)
o Updated the SES7 downstream branding (bsc#1175120, bsc#1175161, bsc#
1175169, bsc#1170498)
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation
methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
o SUSE Enterprise Storage 7:
zypper in -t patch SUSE-Storage-7-2020-3473=1
Package List:
o SUSE Enterprise Storage 7 (aarch64 x86_64):
ceph-base-15.2.5.667+g1a579d5bf2-3.5.1
ceph-base-debuginfo-15.2.5.667+g1a579d5bf2-3.5.1
ceph-common-15.2.5.667+g1a579d5bf2-3.5.1
ceph-common-debuginfo-15.2.5.667+g1a579d5bf2-3.5.1
ceph-debugsource-15.2.5.667+g1a579d5bf2-3.5.1
cephadm-15.2.5.667+g1a579d5bf2-3.5.1
libcephfs2-15.2.5.667+g1a579d5bf2-3.5.1
libcephfs2-debuginfo-15.2.5.667+g1a579d5bf2-3.5.1
librados2-15.2.5.667+g1a579d5bf2-3.5.1
librados2-debuginfo-15.2.5.667+g1a579d5bf2-3.5.1
librbd1-15.2.5.667+g1a579d5bf2-3.5.1
librbd1-debuginfo-15.2.5.667+g1a579d5bf2-3.5.1
librgw2-15.2.5.667+g1a579d5bf2-3.5.1
librgw2-debuginfo-15.2.5.667+g1a579d5bf2-3.5.1
python3-ceph-argparse-15.2.5.667+g1a579d5bf2-3.5.1
python3-ceph-common-15.2.5.667+g1a579d5bf2-3.5.1
python3-cephfs-15.2.5.667+g1a579d5bf2-3.5.1
python3-cephfs-debuginfo-15.2.5.667+g1a579d5bf2-3.5.1
python3-rados-15.2.5.667+g1a579d5bf2-3.5.1
python3-rados-debuginfo-15.2.5.667+g1a579d5bf2-3.5.1
python3-rbd-15.2.5.667+g1a579d5bf2-3.5.1
python3-rbd-debuginfo-15.2.5.667+g1a579d5bf2-3.5.1
python3-rgw-15.2.5.667+g1a579d5bf2-3.5.1
python3-rgw-debuginfo-15.2.5.667+g1a579d5bf2-3.5.1
rbd-nbd-15.2.5.667+g1a579d5bf2-3.5.1
rbd-nbd-debuginfo-15.2.5.667+g1a579d5bf2-3.5.1
References:
o https://www.suse.com/security/cve/CVE-2020-25660.html
o https://bugzilla.suse.com/1163764
o https://bugzilla.suse.com/1170200
o https://bugzilla.suse.com/1170498
o https://bugzilla.suse.com/1173079
o https://bugzilla.suse.com/1174466
o https://bugzilla.suse.com/1174529
o https://bugzilla.suse.com/1174644
o https://bugzilla.suse.com/1175120
o https://bugzilla.suse.com/1175161
o https://bugzilla.suse.com/1175169
o https://bugzilla.suse.com/1176451
o https://bugzilla.suse.com/1176499
o https://bugzilla.suse.com/1176638
o https://bugzilla.suse.com/1177078
o https://bugzilla.suse.com/1177151
o https://bugzilla.suse.com/1177319
o https://bugzilla.suse.com/1177344
o https://bugzilla.suse.com/1177450
o https://bugzilla.suse.com/1177643
o https://bugzilla.suse.com/1177676
o https://bugzilla.suse.com/1177843
o https://bugzilla.suse.com/1177933
o https://bugzilla.suse.com/1178073
o https://bugzilla.suse.com/1178531
- --------------------------------------------------------------------------------
SUSE Security Update: Security update for ceph
______________________________________________________________________________
Announcement ID: SUSE-SU-2020:3539-1
Rating: important
References: #1170200 #1174466 #1177344 #1177843 #1178073 #1178531
Cross-References: CVE-2020-25660
Affected Products:
SUSE Enterprise Storage 7
______________________________________________________________________________
An update that solves one vulnerability and has 5 fixes is now available.
Description:
This update for ceph fixes the following issues:
Security issue fixed:
o CVE-2020-25660: Bring back CEPHX_V2 authorizer challenges (bsc#1177843).
o mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
(bsc#1170200)
o mon: have 'mon stat' output json as well (bsc#1174466)
o mgr/dashboard: support Orchestrator and user-defined Ganesha cluster (bsc#
1177344)
o mgr/dashboard: fix downstream NFS doc links (bsc#1178073)
o cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph
(bsc#1178531)
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation
methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
o SUSE Enterprise Storage 7:
zypper in -t patch SUSE-Storage-7-2020-3539=1
Package List:
o SUSE Enterprise Storage 7 (aarch64 x86_64):
ceph-base-15.2.5.667+g1a579d5bf2-3.3.1
ceph-base-debuginfo-15.2.5.667+g1a579d5bf2-3.3.1
ceph-common-15.2.5.667+g1a579d5bf2-3.3.1
ceph-common-debuginfo-15.2.5.667+g1a579d5bf2-3.3.1
ceph-debugsource-15.2.5.667+g1a579d5bf2-3.3.1
cephadm-15.2.5.667+g1a579d5bf2-3.3.1
libcephfs2-15.2.5.667+g1a579d5bf2-3.3.1
libcephfs2-debuginfo-15.2.5.667+g1a579d5bf2-3.3.1
librados2-15.2.5.667+g1a579d5bf2-3.3.1
librados2-debuginfo-15.2.5.667+g1a579d5bf2-3.3.1
librbd1-15.2.5.667+g1a579d5bf2-3.3.1
librbd1-debuginfo-15.2.5.667+g1a579d5bf2-3.3.1
librgw2-15.2.5.667+g1a579d5bf2-3.3.1
librgw2-debuginfo-15.2.5.667+g1a579d5bf2-3.3.1
python3-ceph-argparse-15.2.5.667+g1a579d5bf2-3.3.1
python3-ceph-common-15.2.5.667+g1a579d5bf2-3.3.1
python3-cephfs-15.2.5.667+g1a579d5bf2-3.3.1
python3-cephfs-debuginfo-15.2.5.667+g1a579d5bf2-3.3.1
python3-rados-15.2.5.667+g1a579d5bf2-3.3.1
python3-rados-debuginfo-15.2.5.667+g1a579d5bf2-3.3.1
python3-rbd-15.2.5.667+g1a579d5bf2-3.3.1
python3-rbd-debuginfo-15.2.5.667+g1a579d5bf2-3.3.1
python3-rgw-15.2.5.667+g1a579d5bf2-3.3.1
python3-rgw-debuginfo-15.2.5.667+g1a579d5bf2-3.3.1
rbd-nbd-15.2.5.667+g1a579d5bf2-3.3.1
rbd-nbd-debuginfo-15.2.5.667+g1a579d5bf2-3.3.1
References:
o https://www.suse.com/security/cve/CVE-2020-25660.html
o https://bugzilla.suse.com/1170200
o https://bugzilla.suse.com/1174466
o https://bugzilla.suse.com/1177344
o https://bugzilla.suse.com/1177843
o https://bugzilla.suse.com/1178073
o https://bugzilla.suse.com/1178531
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBX8RAeuNLKJtyKPYoAQhCxhAAllrPWEqYac0zr6nyOOmTxvv5GME8mjsi
PFhTxtAgvDFuZFlhcmDcxfvbCPR4Vn6YAXRHxQgARekw94WgvPOgwv9nRjdedWwE
uFEyhBouvvRYxYb3PUcizrqZ6EU2yOnE5JaSmVwEcRl4AJDwFG+fwX3nrJu7rqXx
44sXvB3e1wGOXHmOX766gHVOpl1hiQcVkhJS2GgZSGDY+LfNewtAh8l6rgNurjMX
0poOAYxYsdrf44L3cmdZub9SgQmRpfZ4zjKm7wuNqKI5b/MoUNvGxpiV5q6yRbXm
YgH/9Ke232zfopnAPv1KhMpcftNuNCu5yBYJ3AQ+4FJiz8iUWz8OqLxKz9tctpC2
3xxJUJGiiAUIxiG+0pV/0JMWAwVnzYUt9xdFbaubND/UtB1JhHrgsVzHve/Y879G
vsFGUpiIjporD8iU6G2eZN9DcRSs94VRwjWAgvt5lnSy8wB5mItm+fsS9u599zFR
fA+Cv4wFyXc2XdZ5qG1XRQe1A6Vrrmc4qHbTCRbV+ZI1jYS/LRsxw/fuD8rE1kwe
iPjmd+NXSdXpDfaG8aWIxBH8lWN3ImkiAbcUKBbjqEubeg9C9QJ1JlGC9YC3s7oy
CizKuKy+93WPo0m59zImJcBhMzkby6WolBiRCAb4cUS7vNK22zeJ1T8SCKEiGZEC
uDJXuPaIInM=
=+NVu
-----END PGP SIGNATURE-----