Security update for ceph SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2021:1474-1 Final 1 1 2021-05-04T06:59:10Z current 2021-05-04T06:59:10Z 2021-05-04T06:59:10Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for ceph This update for ceph fixes the following issues: - ceph was updated to 15.2.11-83-g8a15f484c2: * CVE-2021-20288: Fixed unauthorized global_id reuse (bsc#1183074). * disk gets replaced with no rocksdb/wal (bsc#1184231). * BlueStore handles huge(>4GB) writes from RocksDB to BlueFS poorly, potentially causing data corruption (bsc#1183899). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container suse/sles/15.2/virt-launcher:0.38.1-2021-1474,Container suse/sles/15.3/virt-launcher:0.45.0-2021-1474,SUSE-2021-1474,SUSE-SLE-Module-Basesystem-15-SP2-2021-1474,SUSE-SLE-Module-Basesystem-15-SP3-2021-1474,SUSE-Storage-7-2021-1474 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2021/suse-su-20211474-1/ Link for SUSE-SU-2021:1474-1 https://lists.suse.com/pipermail/sle-security-updates/2021-May/008722.html E-Mail link for SUSE-SU-2021:1474-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1183074 SUSE Bug 1183074 https://bugzilla.suse.com/1183899 SUSE Bug 1183899 https://bugzilla.suse.com/1184231 SUSE Bug 1184231 https://www.suse.com/security/cve/CVE-2021-20288/ SUSE CVE CVE-2021-20288 page Container suse/sles/15.2/virt-launcher:0.38.1 Container suse/sles/15.3/virt-launcher:0.45.0 SUSE Enterprise Storage 7 SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP3 librados2-15.2.11.83+g8a15f484c2-3.20.1 librbd1-15.2.11.83+g8a15f484c2-3.20.1 ceph-15.2.11.83+g8a15f484c2-3.20.1 ceph-base-15.2.11.83+g8a15f484c2-3.20.1 ceph-common-15.2.11.83+g8a15f484c2-3.20.1 ceph-fuse-15.2.11.83+g8a15f484c2-3.20.1 ceph-grafana-dashboards-15.2.11.83+g8a15f484c2-3.20.1 ceph-immutable-object-cache-15.2.11.83+g8a15f484c2-3.20.1 ceph-mds-15.2.11.83+g8a15f484c2-3.20.1 ceph-mgr-15.2.11.83+g8a15f484c2-3.20.1 ceph-mgr-cephadm-15.2.11.83+g8a15f484c2-3.20.1 ceph-mgr-dashboard-15.2.11.83+g8a15f484c2-3.20.1 ceph-mgr-diskprediction-cloud-15.2.11.83+g8a15f484c2-3.20.1 ceph-mgr-diskprediction-local-15.2.11.83+g8a15f484c2-3.20.1 ceph-mgr-k8sevents-15.2.11.83+g8a15f484c2-3.20.1 ceph-mgr-modules-core-15.2.11.83+g8a15f484c2-3.20.1 ceph-mgr-rook-15.2.11.83+g8a15f484c2-3.20.1 ceph-mon-15.2.11.83+g8a15f484c2-3.20.1 ceph-osd-15.2.11.83+g8a15f484c2-3.20.1 ceph-prometheus-alerts-15.2.11.83+g8a15f484c2-3.20.1 ceph-radosgw-15.2.11.83+g8a15f484c2-3.20.1 ceph-test-15.2.11.83+g8a15f484c2-3.20.1 cephadm-15.2.11.83+g8a15f484c2-3.20.1 cephfs-shell-15.2.11.83+g8a15f484c2-3.20.1 libcephfs-devel-15.2.11.83+g8a15f484c2-3.20.1 libcephfs2-15.2.11.83+g8a15f484c2-3.20.1 librados-devel-15.2.11.83+g8a15f484c2-3.20.1 libradospp-devel-15.2.11.83+g8a15f484c2-3.20.1 librbd-devel-15.2.11.83+g8a15f484c2-3.20.1 librgw-devel-15.2.11.83+g8a15f484c2-3.20.1 librgw2-15.2.11.83+g8a15f484c2-3.20.1 python3-ceph-argparse-15.2.11.83+g8a15f484c2-3.20.1 python3-ceph-common-15.2.11.83+g8a15f484c2-3.20.1 python3-cephfs-15.2.11.83+g8a15f484c2-3.20.1 python3-rados-15.2.11.83+g8a15f484c2-3.20.1 python3-rbd-15.2.11.83+g8a15f484c2-3.20.1 python3-rgw-15.2.11.83+g8a15f484c2-3.20.1 rados-objclass-devel-15.2.11.83+g8a15f484c2-3.20.1 rbd-fuse-15.2.11.83+g8a15f484c2-3.20.1 rbd-mirror-15.2.11.83+g8a15f484c2-3.20.1 rbd-nbd-15.2.11.83+g8a15f484c2-3.20.1 librados2-15.2.11.83+g8a15f484c2-3.20.1 as a component of Container suse/sles/15.2/virt-launcher:0.38.1 librbd1-15.2.11.83+g8a15f484c2-3.20.1 as a component of Container suse/sles/15.2/virt-launcher:0.38.1 librados2-15.2.11.83+g8a15f484c2-3.20.1 as a component of Container suse/sles/15.3/virt-launcher:0.45.0 librbd1-15.2.11.83+g8a15f484c2-3.20.1 as a component of Container suse/sles/15.3/virt-launcher:0.45.0 ceph-base-15.2.11.83+g8a15f484c2-3.20.1 as a component of SUSE Enterprise Storage 7 ceph-common-15.2.11.83+g8a15f484c2-3.20.1 as a component of SUSE Enterprise Storage 7 cephadm-15.2.11.83+g8a15f484c2-3.20.1 as a component of SUSE Enterprise Storage 7 libcephfs2-15.2.11.83+g8a15f484c2-3.20.1 as a component of SUSE Enterprise Storage 7 librados2-15.2.11.83+g8a15f484c2-3.20.1 as a component of SUSE Enterprise Storage 7 librbd1-15.2.11.83+g8a15f484c2-3.20.1 as a component of SUSE Enterprise Storage 7 librgw2-15.2.11.83+g8a15f484c2-3.20.1 as a component of SUSE Enterprise Storage 7 python3-ceph-argparse-15.2.11.83+g8a15f484c2-3.20.1 as a component of SUSE Enterprise Storage 7 python3-ceph-common-15.2.11.83+g8a15f484c2-3.20.1 as a component of SUSE Enterprise Storage 7 python3-cephfs-15.2.11.83+g8a15f484c2-3.20.1 as a component of SUSE Enterprise Storage 7 python3-rados-15.2.11.83+g8a15f484c2-3.20.1 as a component of SUSE Enterprise Storage 7 python3-rbd-15.2.11.83+g8a15f484c2-3.20.1 as a component of SUSE Enterprise Storage 7 python3-rgw-15.2.11.83+g8a15f484c2-3.20.1 as a component of SUSE Enterprise Storage 7 rbd-nbd-15.2.11.83+g8a15f484c2-3.20.1 as a component of SUSE Enterprise Storage 7 ceph-common-15.2.11.83+g8a15f484c2-3.20.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 libcephfs-devel-15.2.11.83+g8a15f484c2-3.20.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 libcephfs2-15.2.11.83+g8a15f484c2-3.20.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 librados-devel-15.2.11.83+g8a15f484c2-3.20.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 librados2-15.2.11.83+g8a15f484c2-3.20.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 libradospp-devel-15.2.11.83+g8a15f484c2-3.20.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 librbd-devel-15.2.11.83+g8a15f484c2-3.20.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 librbd1-15.2.11.83+g8a15f484c2-3.20.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 librgw-devel-15.2.11.83+g8a15f484c2-3.20.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 librgw2-15.2.11.83+g8a15f484c2-3.20.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 python3-ceph-argparse-15.2.11.83+g8a15f484c2-3.20.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 python3-ceph-common-15.2.11.83+g8a15f484c2-3.20.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 python3-cephfs-15.2.11.83+g8a15f484c2-3.20.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 python3-rados-15.2.11.83+g8a15f484c2-3.20.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 python3-rbd-15.2.11.83+g8a15f484c2-3.20.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 python3-rgw-15.2.11.83+g8a15f484c2-3.20.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 rados-objclass-devel-15.2.11.83+g8a15f484c2-3.20.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 rbd-nbd-15.2.11.83+g8a15f484c2-3.20.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 ceph-common-15.2.11.83+g8a15f484c2-3.20.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 libcephfs-devel-15.2.11.83+g8a15f484c2-3.20.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 libcephfs2-15.2.11.83+g8a15f484c2-3.20.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 librados-devel-15.2.11.83+g8a15f484c2-3.20.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 librados2-15.2.11.83+g8a15f484c2-3.20.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 libradospp-devel-15.2.11.83+g8a15f484c2-3.20.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 librbd-devel-15.2.11.83+g8a15f484c2-3.20.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 librbd1-15.2.11.83+g8a15f484c2-3.20.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 librgw-devel-15.2.11.83+g8a15f484c2-3.20.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 librgw2-15.2.11.83+g8a15f484c2-3.20.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 python3-ceph-argparse-15.2.11.83+g8a15f484c2-3.20.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 python3-ceph-common-15.2.11.83+g8a15f484c2-3.20.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 python3-cephfs-15.2.11.83+g8a15f484c2-3.20.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 python3-rados-15.2.11.83+g8a15f484c2-3.20.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 python3-rbd-15.2.11.83+g8a15f484c2-3.20.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 python3-rgw-15.2.11.83+g8a15f484c2-3.20.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 rados-objclass-devel-15.2.11.83+g8a15f484c2-3.20.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 rbd-nbd-15.2.11.83+g8a15f484c2-3.20.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse. An attacker who can request a global_id can exploit the ability of any user to request a global_id previously associated with another user, as ceph does not force the reuse of old keys to generate new ones. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. CVE-2021-20288 Container suse/sles/15.2/virt-launcher:0.38.1:librados2-15.2.11.83+g8a15f484c2-3.20.1 Container suse/sles/15.2/virt-launcher:0.38.1:librbd1-15.2.11.83+g8a15f484c2-3.20.1 Container suse/sles/15.3/virt-launcher:0.45.0:librados2-15.2.11.83+g8a15f484c2-3.20.1 Container suse/sles/15.3/virt-launcher:0.45.0:librbd1-15.2.11.83+g8a15f484c2-3.20.1 SUSE Enterprise Storage 7:ceph-base-15.2.11.83+g8a15f484c2-3.20.1 SUSE Enterprise Storage 7:ceph-common-15.2.11.83+g8a15f484c2-3.20.1 SUSE Enterprise Storage 7:cephadm-15.2.11.83+g8a15f484c2-3.20.1 SUSE Enterprise Storage 7:libcephfs2-15.2.11.83+g8a15f484c2-3.20.1 SUSE Enterprise Storage 7:librados2-15.2.11.83+g8a15f484c2-3.20.1 SUSE Enterprise Storage 7:librbd1-15.2.11.83+g8a15f484c2-3.20.1 SUSE Enterprise Storage 7:librgw2-15.2.11.83+g8a15f484c2-3.20.1 SUSE Enterprise Storage 7:python3-ceph-argparse-15.2.11.83+g8a15f484c2-3.20.1 SUSE Enterprise Storage 7:python3-ceph-common-15.2.11.83+g8a15f484c2-3.20.1 SUSE Enterprise Storage 7:python3-cephfs-15.2.11.83+g8a15f484c2-3.20.1 SUSE Enterprise Storage 7:python3-rados-15.2.11.83+g8a15f484c2-3.20.1 SUSE Enterprise Storage 7:python3-rbd-15.2.11.83+g8a15f484c2-3.20.1 SUSE Enterprise Storage 7:python3-rgw-15.2.11.83+g8a15f484c2-3.20.1 SUSE Enterprise Storage 7:rbd-nbd-15.2.11.83+g8a15f484c2-3.20.1 SUSE Linux Enterprise Module for Basesystem 15 SP2:ceph-common-15.2.11.83+g8a15f484c2-3.20.1 SUSE Linux Enterprise Module for Basesystem 15 SP2:libcephfs-devel-15.2.11.83+g8a15f484c2-3.20.1 SUSE Linux Enterprise Module for Basesystem 15 SP2:libcephfs2-15.2.11.83+g8a15f484c2-3.20.1 SUSE Linux Enterprise Module for Basesystem 15 SP2:librados-devel-15.2.11.83+g8a15f484c2-3.20.1 SUSE Linux Enterprise Module for Basesystem 15 SP2:librados2-15.2.11.83+g8a15f484c2-3.20.1 SUSE Linux Enterprise Module for Basesystem 15 SP2:libradospp-devel-15.2.11.83+g8a15f484c2-3.20.1 SUSE Linux Enterprise Module for Basesystem 15 SP2:librbd-devel-15.2.11.83+g8a15f484c2-3.20.1 SUSE Linux Enterprise Module for Basesystem 15 SP2:librbd1-15.2.11.83+g8a15f484c2-3.20.1 SUSE Linux Enterprise Module for Basesystem 15 SP2:librgw-devel-15.2.11.83+g8a15f484c2-3.20.1 SUSE Linux Enterprise Module for Basesystem 15 SP2:librgw2-15.2.11.83+g8a15f484c2-3.20.1 SUSE Linux Enterprise Module for Basesystem 15 SP2:python3-ceph-argparse-15.2.11.83+g8a15f484c2-3.20.1 SUSE Linux Enterprise Module for Basesystem 15 SP2:python3-ceph-common-15.2.11.83+g8a15f484c2-3.20.1 SUSE Linux Enterprise Module for Basesystem 15 SP2:python3-cephfs-15.2.11.83+g8a15f484c2-3.20.1 SUSE Linux Enterprise Module for Basesystem 15 SP2:python3-rados-15.2.11.83+g8a15f484c2-3.20.1 SUSE Linux Enterprise Module for Basesystem 15 SP2:python3-rbd-15.2.11.83+g8a15f484c2-3.20.1 SUSE Linux Enterprise Module for Basesystem 15 SP2:python3-rgw-15.2.11.83+g8a15f484c2-3.20.1 SUSE Linux Enterprise Module for Basesystem 15 SP2:rados-objclass-devel-15.2.11.83+g8a15f484c2-3.20.1 SUSE Linux Enterprise Module for Basesystem 15 SP2:rbd-nbd-15.2.11.83+g8a15f484c2-3.20.1 SUSE Linux Enterprise Module for Basesystem 15 SP3:ceph-common-15.2.11.83+g8a15f484c2-3.20.1 SUSE Linux Enterprise Module for Basesystem 15 SP3:libcephfs-devel-15.2.11.83+g8a15f484c2-3.20.1 SUSE Linux Enterprise Module for Basesystem 15 SP3:libcephfs2-15.2.11.83+g8a15f484c2-3.20.1 SUSE Linux Enterprise Module for Basesystem 15 SP3:librados-devel-15.2.11.83+g8a15f484c2-3.20.1 SUSE Linux Enterprise Module for Basesystem 15 SP3:librados2-15.2.11.83+g8a15f484c2-3.20.1 SUSE Linux Enterprise Module for Basesystem 15 SP3:libradospp-devel-15.2.11.83+g8a15f484c2-3.20.1 SUSE Linux Enterprise Module for Basesystem 15 SP3:librbd-devel-15.2.11.83+g8a15f484c2-3.20.1 SUSE Linux Enterprise Module for Basesystem 15 SP3:librbd1-15.2.11.83+g8a15f484c2-3.20.1 SUSE Linux Enterprise Module for Basesystem 15 SP3:librgw-devel-15.2.11.83+g8a15f484c2-3.20.1 SUSE Linux Enterprise Module for Basesystem 15 SP3:librgw2-15.2.11.83+g8a15f484c2-3.20.1 SUSE Linux Enterprise Module for Basesystem 15 SP3:python3-ceph-argparse-15.2.11.83+g8a15f484c2-3.20.1 SUSE Linux Enterprise Module for Basesystem 15 SP3:python3-ceph-common-15.2.11.83+g8a15f484c2-3.20.1 SUSE Linux Enterprise Module for Basesystem 15 SP3:python3-cephfs-15.2.11.83+g8a15f484c2-3.20.1 SUSE Linux Enterprise Module for Basesystem 15 SP3:python3-rados-15.2.11.83+g8a15f484c2-3.20.1 SUSE Linux Enterprise Module for Basesystem 15 SP3:python3-rbd-15.2.11.83+g8a15f484c2-3.20.1 SUSE Linux Enterprise Module for Basesystem 15 SP3:python3-rgw-15.2.11.83+g8a15f484c2-3.20.1 SUSE Linux Enterprise Module for Basesystem 15 SP3:rados-objclass-devel-15.2.11.83+g8a15f484c2-3.20.1 SUSE Linux Enterprise Module for Basesystem 15 SP3:rbd-nbd-15.2.11.83+g8a15f484c2-3.20.1 important 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20211474-1/ https://www.suse.com/security/cve/CVE-2021-20288.html CVE-2021-20288 https://bugzilla.suse.com/1183074 SUSE Bug 1183074 https://bugzilla.suse.com/1205049 SUSE Bug 1205049