SUSE-SU-2017:0758-1: moderate: Security update for ceph

[sle-security-updates at lists.suse.com]

   SUSE Security Update: Security update for ceph
______________________________________________________________________________

Announcement ID:    SUSE-SU-2017:0758-1
Rating:             moderate
References:         #1007217 #1008435 #1008894 #1012100 #1014338 
                    #1015748 #1019616 
Cross-References:   CVE-2016-8626
Affected Products:
                    SUSE Enterprise Storage 3
______________________________________________________________________________

   An update that solves one vulnerability and has 6 fixes is
   now available.

Description:


   This update provides Ceph 10.2.5, which brings fixes and enhancements:

   This security issue was fixed:

   - CVE-2016-8626: Handle empty POST condition to not allow attackers to
     crash the ceph-radosgw service. (bsc#1007217)

   These non-security issues were fixed:

   - OSD daemon uses 100% CPU load after OSD creation (bsc#1014338)
   - ceph-deploy fails with dmcrypt flag (bsc#1008435)
   - OSD's are not mounted after upgrade (bsc#1012100)
   - ceph-osd service fails to start OSD randomly (bsc#1019616)
   - Add missing argument comma to ceph-create-keys (bsc#1008894)
   - Add Install section to systemd rbdmap.service file (bsc#1015748)


Patch Instructions:

   To install this SUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - SUSE Enterprise Storage 3:

      zypper in -t patch SUSE-Storage-3-2017-416=1

   To bring your system up-to-date, use "zypper patch".


Package List:

   - SUSE Enterprise Storage 3 (aarch64 x86_64):

      ceph-10.2.5+git.1485186288.4e3c6c4-12.2
      ceph-base-10.2.5+git.1485186288.4e3c6c4-12.2
      ceph-base-debuginfo-10.2.5+git.1485186288.4e3c6c4-12.2
      ceph-common-10.2.5+git.1485186288.4e3c6c4-12.2
      ceph-common-debuginfo-10.2.5+git.1485186288.4e3c6c4-12.2
      ceph-debugsource-10.2.5+git.1485186288.4e3c6c4-12.2
      ceph-fuse-10.2.5+git.1485186288.4e3c6c4-12.2
      ceph-fuse-debuginfo-10.2.5+git.1485186288.4e3c6c4-12.2
      ceph-mds-10.2.5+git.1485186288.4e3c6c4-12.2
      ceph-mds-debuginfo-10.2.5+git.1485186288.4e3c6c4-12.2
      ceph-mon-10.2.5+git.1485186288.4e3c6c4-12.2
      ceph-mon-debuginfo-10.2.5+git.1485186288.4e3c6c4-12.2
      ceph-osd-10.2.5+git.1485186288.4e3c6c4-12.2
      ceph-osd-debuginfo-10.2.5+git.1485186288.4e3c6c4-12.2
      ceph-radosgw-10.2.5+git.1485186288.4e3c6c4-12.2
      ceph-radosgw-debuginfo-10.2.5+git.1485186288.4e3c6c4-12.2
      ceph-test-10.2.5+git.1485186288.4e3c6c4-12.2
      ceph-test-debuginfo-10.2.5+git.1485186288.4e3c6c4-12.2
      ceph-test-debugsource-10.2.5+git.1485186288.4e3c6c4-12.2
      libcephfs1-10.2.5+git.1485186288.4e3c6c4-12.2
      libcephfs1-debuginfo-10.2.5+git.1485186288.4e3c6c4-12.2
      librados2-10.2.5+git.1485186288.4e3c6c4-12.2
      librados2-debuginfo-10.2.5+git.1485186288.4e3c6c4-12.2
      libradosstriper1-10.2.5+git.1485186288.4e3c6c4-12.2
      libradosstriper1-debuginfo-10.2.5+git.1485186288.4e3c6c4-12.2
      librbd1-10.2.5+git.1485186288.4e3c6c4-12.2
      librbd1-debuginfo-10.2.5+git.1485186288.4e3c6c4-12.2
      librgw2-10.2.5+git.1485186288.4e3c6c4-12.2
      librgw2-debuginfo-10.2.5+git.1485186288.4e3c6c4-12.2
      python-ceph-compat-10.2.5+git.1485186288.4e3c6c4-12.2
      python-cephfs-10.2.5+git.1485186288.4e3c6c4-12.2
      python-cephfs-debuginfo-10.2.5+git.1485186288.4e3c6c4-12.2
      python-rados-10.2.5+git.1485186288.4e3c6c4-12.2
      python-rados-debuginfo-10.2.5+git.1485186288.4e3c6c4-12.2
      python-rbd-10.2.5+git.1485186288.4e3c6c4-12.2
      python-rbd-debuginfo-10.2.5+git.1485186288.4e3c6c4-12.2
      rbd-fuse-10.2.5+git.1485186288.4e3c6c4-12.2
      rbd-fuse-debuginfo-10.2.5+git.1485186288.4e3c6c4-12.2
      rbd-mirror-10.2.5+git.1485186288.4e3c6c4-12.2
      rbd-mirror-debuginfo-10.2.5+git.1485186288.4e3c6c4-12.2
      rbd-nbd-10.2.5+git.1485186288.4e3c6c4-12.2
      rbd-nbd-debuginfo-10.2.5+git.1485186288.4e3c6c4-12.2


References:

   https://www.suse.com/security/cve/CVE-2016-8626.html
   https://bugzilla.suse.com/1007217
   https://bugzilla.suse.com/1008435
   https://bugzilla.suse.com/1008894
   https://bugzilla.suse.com/1012100
   https://bugzilla.suse.com/1014338
   https://bugzilla.suse.com/1015748
   https://bugzilla.suse.com/1019616