SUSE-SU-2023:1584-1
See a problem?- Import Source
- https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2023:1584-1.json
- JSON Data
- https://api.osv.dev/v1/vulns/SUSE-SU-2023:1584-1
- Related
- Published
- 2023-03-27T08:32:33Z
- Modified
- 2023-03-27T08:32:33Z
- Summary
- Security update for ceph
- Details
-
This update for ceph fixes the following issues:
Security issues fixed:
- CVE-2022-0670: Fixed user/tenant read/write access to an entire file system (bsc#1201837).
- CVE-2022-3650: Fixed Python script that allowed privilege escalation from ceph to root (bsc#1204430).
- CVE-2022-3854: Fixed possible DoS issue in ceph URL processing on RGW backends (bsc#1205025).
Bug fixes:
- osd, tools, kv: non-aggressive, on-line trimming of accumulated dups (bsc#1199183).
- ceph-volume: fix fast device alloc size on mulitple device (bsc#1200262).
- cephadm: update monitoring container images (bsc#1200501).
- mgr/dashboard: prevent alert redirect (bsc#1200978).
- mgr/volumes: Add subvolumegroup resize cmd (bsc#1201797).
- monitoring/ceph-mixin: add RGW host to label info (bsc#1201976).
- mgr/dashboard: enable addition of custom Prometheus alerts (bsc#1202077).
- python-common: Add 'KB' to supported suffixes in SizeMatcher (bsc#1203375).
- mgr/dashboard: fix rgw connect when using ssl (bsc#1205436).
- ceph.spec.in: Add -DFMTDEPRECATEDOSTREAM to CXXFLAGS (bsc#1202292).
- cephfs-shell: move source to separate subdirectory (bsc#1201604).
Fix in previous release:
- mgr/cephadm: try to get FQDN for configuration files (bsc#1196046).
- When an RBD is mapped, it is attempted to be deployed as an OSD. (bsc#1187748).
- OSD marked down causes wrong backfill_toofull (bsc#1188911).
- cephadm: Fix iscsi client caps (allow mgr <service status> calls) (bsc#1192838).
- mgr/cephadm: fix and improve osd draining (bsc#1200317).
- add iscsi and nfs to upgrade process (bsc#1206158).
- mgr/mgr_module.py: CLICommand: Fix parsing of kwargs arguments (bsc#1192840).
- References
-
- https://www.suse.com/support/update/announcement/2023/suse-su-20231584-1/
- https://bugzilla.suse.com/1187748
- https://bugzilla.suse.com/1188911
- https://bugzilla.suse.com/1192838
- https://bugzilla.suse.com/1192840
- https://bugzilla.suse.com/1196046
- https://bugzilla.suse.com/1199183
- https://bugzilla.suse.com/1200262
- https://bugzilla.suse.com/1200317
- https://bugzilla.suse.com/1200501
- https://bugzilla.suse.com/1200978
- https://bugzilla.suse.com/1201604
- https://bugzilla.suse.com/1201797
- https://bugzilla.suse.com/1201837
- https://bugzilla.suse.com/1201976
- https://bugzilla.suse.com/1202077
- https://bugzilla.suse.com/1202292
- https://bugzilla.suse.com/1203375
- https://bugzilla.suse.com/1204430
- https://bugzilla.suse.com/1205025
- https://bugzilla.suse.com/1205436
- https://bugzilla.suse.com/1206158
- https://www.suse.com/security/cve/CVE-2022-0670
- https://www.suse.com/security/cve/CVE-2022-3650
- https://www.suse.com/security/cve/CVE-2022-3854
Affected packages
SUSE:Enterprise Storage 7.1 / ceph
Package
- Name
- ceph
- Purl
- purl:rpm/suse/ceph&distro=SUSE%20Enterprise%20Storage%207.1
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed16.2.11.58+g38d6afd3b78-150300.3.6.1
Ecosystem specific
{
"binaries": [
{
"python3-cephfs": "16.2.11.58+g38d6afd3b78-150300.3.6.1",
"python3-rados": "16.2.11.58+g38d6afd3b78-150300.3.6.1",
"librbd1": "16.2.11.58+g38d6afd3b78-150300.3.6.1",
"ceph-common": "16.2.11.58+g38d6afd3b78-150300.3.6.1",
"python3-ceph-argparse": "16.2.11.58+g38d6afd3b78-150300.3.6.1",
"librgw2": "16.2.11.58+g38d6afd3b78-150300.3.6.1",
"python3-rbd": "16.2.11.58+g38d6afd3b78-150300.3.6.1",
"libcephfs2": "16.2.11.58+g38d6afd3b78-150300.3.6.1",
"librados2": "16.2.11.58+g38d6afd3b78-150300.3.6.1",
"ceph-base": "16.2.11.58+g38d6afd3b78-150300.3.6.1",
"python3-rgw": "16.2.11.58+g38d6afd3b78-150300.3.6.1",
"rbd-nbd": "16.2.11.58+g38d6afd3b78-150300.3.6.1",
"cephadm": "16.2.11.58+g38d6afd3b78-150300.3.6.1",
"python3-ceph-common": "16.2.11.58+g38d6afd3b78-150300.3.6.1"
}
]
}