SUSE-CU-2022:57-1: Security update of ses/7/rook/ceph
sle-updates at lists.suse.com
sle-updates at lists.suse.com
Tue Jan 25 08:02:05 UTC 2022
SUSE Container Update Advisory: ses/7/rook/ceph
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2022:57-1
Container Tags : ses/7/rook/ceph:1.7.7 , ses/7/rook/ceph:1.7.7.0 , ses/7/rook/ceph:1.7.7.0.1.1903 , ses/7/rook/ceph:latest , ses/7/rook/ceph:sle15.2.octopus
Container Release : 1.1903
Severity : critical
Type : security
References : 1027496 1029961 1065729 1085917 1113013 1122417 1125886 1134353
1148868 1152489 1154353 1159886 1161276 1162581 1164548 1167773
1169614 1170774 1171962 1172505 1172973 1172974 1173746 1174504
1174504 1176473 1176940 1177100 1177460 1178236 1179416 1179898
1179899 1179900 1179901 1179902 1179903 1180064 1180125 1180125
1180451 1180454 1180461 1181291 1181299 1181306 1181309 1181371
1181452 1181535 1181536 1182252 1183028 1183085 1183374 1183511
1183543 1183545 1183561 1183632 1183659 1183818 1183858 1183905
1183909 1184439 1184517 1184519 1184614 1184620 1184794 1184804
1184994 1185016 1185246 1185299 1185302 1185524 1185588 1185677
1185726 1185748 1185762 1185768 1186348 1186489 1186503 1186602
1186910 1187153 1187167 1187196 1187224 1187270 1187273 1187338
1187425 1187466 1187512 1187654 1187668 1187670 1187738 1187760
1187911 1187993 1188018 1188063 1188067 1188156 1188291 1188344
1188435 1188548 1188623 1188651 1188651 1188713 1188921 1188941
1188979 1188986 1189031 1189173 1189206 1189241 1189287 1189297
1189465 1189465 1189480 1189520 1189521 1189521 1189534 1189552
1189554 1189803 1189841 1189841 1189884 1189929 1189983 1189984
1189996 1190023 1190052 1190059 1190062 1190115 1190159 1190199
1190234 1190325 1190356 1190358 1190373 1190374 1190406 1190432
1190440 1190465 1190467 1190523 1190534 1190543 1190576 1190595
1190596 1190598 1190598 1190620 1190626 1190645 1190679 1190705
1190712 1190717 1190739 1190746 1190758 1190772 1190784 1190785
1190793 1190815 1190858 1190915 1190933 1190984 1191019 1191172
1191193 1191200 1191240 1191252 1191260 1191286 1191292 1191324
1191370 1191473 1191480 1191500 1191563 1191566 1191609 1191630
1191675 1191690 1191690 1191736 1191804 1191922 1191987 1192161
1192248 1192267 1192337 1192367 1192436 1192489 1192688 1192717
1192840 1193181 1193480 1193481 1193521 1193711 CVE-2016-10228
CVE-2019-20838 CVE-2020-12049 CVE-2020-14155 CVE-2020-16590 CVE-2020-16591
CVE-2020-16592 CVE-2020-16593 CVE-2020-16598 CVE-2020-16599 CVE-2020-29361
CVE-2020-35448 CVE-2020-35493 CVE-2020-35496 CVE-2020-35507 CVE-2020-3702
CVE-2021-20197 CVE-2021-20266 CVE-2021-20271 CVE-2021-20284 CVE-2021-20294
CVE-2021-22946 CVE-2021-22947 CVE-2021-33574 CVE-2021-33910 CVE-2021-3421
CVE-2021-3426 CVE-2021-3487 CVE-2021-35942 CVE-2021-3669 CVE-2021-3711
CVE-2021-3712 CVE-2021-3712 CVE-2021-3733 CVE-2021-3737 CVE-2021-3744
CVE-2021-3752 CVE-2021-37600 CVE-2021-3764 CVE-2021-37750 CVE-2021-38185
CVE-2021-38185 CVE-2021-39537 CVE-2021-40490 CVE-2021-42771 CVE-2021-43618
-----------------------------------------------------------------
The container ses/7/rook/ceph was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: SUSE-OU-2020:3026-1
Released: Fri Oct 23 15:35:49 2020
Summary: Optional update for the Public Cloud Module
Type: optional
Severity: moderate
References:
This update adds the Google Cloud Storage packages to the Public Cloud module (jsc#ECO-2398).
The following packages were included:
- python3-grpcio
- python3-protobuf
- python3-google-api-core
- python3-google-cloud-core
- python3-google-cloud-storage
- python3-google-resumable-media
- python3-googleapis-common-protos
- python3-grpcio-gcp
- python3-mock (updated to version 3.0.5)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:294-1
Released: Wed Feb 3 12:54:28 2021
Summary: Recommended update for libprotobuf
Type: recommended
Severity: moderate
References:
libprotobuf was updated to fix:
- ship the libprotobuf-lite15 on the basesystem module and the INSTALLER channel. (jsc#ECO-2911)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:2689-1
Released: Mon Aug 16 10:54:52 2021
Summary: Security update for cpio
Type: security
Severity: important
References: 1189206,CVE-2021-38185
This update for cpio fixes the following issues:
It was possible to trigger Remote code execution due to a integer overflow (CVE-2021-38185, bsc#1189206)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:2763-1
Released: Tue Aug 17 17:16:22 2021
Summary: Recommended update for cpio
Type: recommended
Severity: critical
References: 1189465
This update for cpio fixes the following issues:
- A regression in last update would cause builds to hang on various architectures(bsc#1189465)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:2780-1
Released: Thu Aug 19 16:09:15 2021
Summary: Recommended update for cpio
Type: recommended
Severity: critical
References: 1189465,CVE-2021-38185
This update for cpio fixes the following issues:
- A regression in the previous update could lead to crashes (bsc#1189465)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:2810-1
Released: Mon Aug 23 12:14:30 2021
Summary: Security update for dbus-1
Type: security
Severity: moderate
References: 1172505,CVE-2020-12049
This update for dbus-1 fixes the following issues:
- CVE-2020-12049: truncated messages lead to resource exhaustion. (bsc#1172505)
-----------------------------------------------------------------
Advisory ID: SUSE-OU-2021:2816-1
Released: Mon Aug 23 14:16:58 2021
Summary: Optional update for python-kubernetes
Type: optional
Severity: low
References:
This patch provides the python3-kubernetes package to the following modules:
- Container Module for SUSE Linux Enterprise 15 SP2
- Container Module for SUSE Linux Enterprise 15 SP3
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:2830-1
Released: Tue Aug 24 16:20:18 2021
Summary: Security update for openssl-1_1
Type: security
Severity: important
References: 1189520,1189521,CVE-2021-3711,CVE-2021-3712
This update for openssl-1_1 fixes the following security issues:
- CVE-2021-3711: A bug in the implementation of the SM2 decryption code
could lead to buffer overflows. [bsc#1189520]
- CVE-2021-3712: a bug in the code for printing certificate details could
lead to a buffer overrun that a malicious actor could exploit to crash
the application, causing a denial-of-service attack. [bsc#1189521]
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:2863-1
Released: Mon Aug 30 08:18:50 2021
Summary: Recommended update for python-dbus-python
Type: recommended
Severity: moderate
References: 1183818
This update for python-dbus-python fixes the following issues:
- Update to latest version from tumbleweed. (jsc#ECO-3589, bsc#1183818)
- update to 1.2.16:
* All tests are run even if the 'tap.py' module is not available, althoug diagnostics for failing tests will be better if it is present.
- Support builds with more than one python3 flavor
- Clean duplicate python flavor variables for configure
- Version update to version 1.2.14:
* Ensure that the numeric types from dbus.types get the same str() under Python 3.8 that they did under previous versions.
* Disable -Winline.
* Add clearer license information using SPDX-License-Identifier.
* Include inherited methods and properties when documenting objects, which regressed when migrating from epydoc to sphinx.
* Add missing variant_level member to UnixFd type, for parity with the other dbus.types types
* Don't reply to method calls if they have the NO_REPLY_EXPECTED flag
* Silence '-Wcast-function-type' with gcc 8.
* Fix distcheck with python3.7 by deleting '__pycache__' during uninstall.
* Consistently save and restore the exception indicator when called from C code.
- Add missing dependency for pkg-config files
- Version update to version 1.2.8:
* Python 2.7 required or 3.4 respectively
* Upstream dropped epydoc completely
- Add dbus-1-python3 package
- Make BusConnection.list_activatable_names actually call struct entries than the signature allows with libdbus 1.4 imports dbus, is finalized, is re-initialized, and re-imports - When removing signal matches, clean up internal state, avoiding a memory leak in long-lived Python processes that connect to
- When setting the sender of a message, allow it to be org.freedesktop.DBus so you can implement a D-Bus daemon
- New package: dbus-1-python-devel
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:2895-1
Released: Tue Aug 31 19:40:50 2021
Summary: Recommended update for unixODBC
Type: recommended
Severity: moderate
References:
This update for unixODBC fixes the following issues:
- ECO: Update unixODBC to 2.3.9 in SLE 15. (jsc#SLE-18004)
- Fix incorrect permission for documentation files.
- Update requires and baselibs for new libodbc2.
- Employ shared library packaging guideline: new subpacakge libodbc2.
- Update to 2.3.9:
* Remove '#define UNIXODBC_SOURCE' from unixodbc_conf.h
- Update to 2.3.8:
* Add configure support for editline
* SQLDriversW was ignoring user config
* SQLDataSources Fix termination character
* Fix for pooling seg fault
* Make calling SQLSetStmtAttrW call the W function in the driver is its there
* Try and fix race condition clearing system odbc.ini file
* Remove trailing space from isql/iusql SQL
* When setting connection attributes set before connect also check if the W entry poins can be used
* Try calling the W error functions first if available in the driver
* Add iconvperdriver configure option to allow calling unicode_setup in SQLAllocHandle
* iconv handles was being lost when reusing pooled connection
* Catch null copy in iniPropertyInsert
* Fix a few leaks
- Update to 2.3.7:
* Fix for pkg-config file update on no linux platforms
* Add W entry for GUI work
* Various fixes for SQLBrowseConnect/W, SQLGetConnectAttr/W,and SQLSetConnectAttr/W
* Fix buffer overflows in SQLConnect/W and refine behaviour of SQLGet/WritePrivateProfileString
* SQLBrowseConnect/W allow disconnecting a started browse session after error
* Add --with-stats-ftok-name configure option to allow the selection of a file name
used to generate the IPC id when collecting stats. Default is the system odbc.ini file
* Improve diag record handling with the behavior of Windows DM and export SQLCancelHandle
* bug fix when SQLGetPrivateProfileString() is called to get a list of sections or a list of keys
* Connection pooling: Fix liveness check for Unicode drivers
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:2938-1
Released: Fri Sep 3 09:19:36 2021
Summary: Recommended update for openldap2
Type: recommended
Severity: moderate
References: 1184614
This update for openldap2 fixes the following issue:
- openldap2-contrib is shipped to the Legacy Module. (bsc#1184614)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:2966-1
Released: Tue Sep 7 09:49:14 2021
Summary: Security update for openssl-1_1
Type: security
Severity: low
References: 1189521,CVE-2021-3712
This update for openssl-1_1 fixes the following issues:
- CVE-2021-3712: This is an update for the incomplete fix for CVE-2021-3712.
Read buffer overruns processing ASN.1 strings (bsc#1189521).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:3021-1
Released: Mon Sep 13 10:32:31 2021
Summary: Recommended update for ceph
Type: recommended
Severity: moderate
References: 1181291,1183561,1184517,1185246,1186348,1188979,1189173
This update for ceph fixes the following issues:
- cls/rgw: look for plane entries in non-ascii plain namespace too (bsc#1184517)
- rgw: check object locks in multi-object delete (bsc#1185246)
- mgr/zabbix: adapt zabbix_sender default path (bsc#1186348)
- mgr/cephadm: pass --container-init to 'cephadm deploy' if specified (bsc#1188979)
- mgr/dashboard: Downstream branding: Adapt latest upstream changes to branded navigation component (bsc#1189173)
- qa/tasks/salt_manager: allow gatherlogs for files in subdir
- qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
- mgr/zabbix: adapt zabbix_sender default path (bsc#1186348)
- Revert 'cephadm: default container_init to False' (bsc#1188979)
- mgr/cephadm: alias rgw-nfs -> nfs (bsc#1181291)
- mgr/cephadm: on ssh connection error, advice chmod 0600 (bsc#1183561)
- Update _constraints: only honor physical memory, not 'any memory' (e.g. swap).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:3030-1
Released: Tue Sep 14 09:27:45 2021
Summary: Recommended update for patterns-base
Type: recommended
Severity: moderate
References: 1189534,1189554
This update of patterns-base fixes the following issue:
- The fips pattern should also install 'openssh-fips' if 'openssh' is installed (bsc#1189554 bsc#1189534)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:3034-1
Released: Tue Sep 14 13:49:23 2021
Summary: Recommended update for python-pytz
Type: recommended
Severity: moderate
References: 1185748
This update for python-pytz fixes the following issues:
- Add %pyunittest shim for platforms where it is missing.
- Remove real directory of %{python_sitelib}/pytz/zoneinfo when upgrading, before it is replaced by a symlink. (bsc#1185748)
- update to 2021.1:
* update to IANA 2021a timezone release
- update to 2020.5:
* update to IANA 2020e timezone release
- update to 2020.4:
* update to IANA 2020d timezone release
- update to version 2020.1:
* Test against Python 3.8 and Python 3.9
* Bump version numbers to 2020.1/2020a
* use .rst extension name
* Make FixedOffset part of public API
- Update to 2019.3
* IANA 2019c
- Add versioned dependency on timezone database to ensure the correct data is installed
- Add a symlink to the system timezone database
- update to 2019.2
* IANA 2019b
* Defer generating case-insensitive lookups
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:3182-1
Released: Tue Sep 21 17:04:26 2021
Summary: Recommended update for file
Type: recommended
Severity: moderate
References: 1189996
This update for file fixes the following issues:
- Fixes exception thrown by memory allocation problem (bsc#1189996)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:3233-1
Released: Mon Sep 27 15:02:21 2021
Summary: Recommended update for xfsprogs
Type: recommended
Severity: moderate
References: 1085917,1181299,1181306,1181309,1181535,1181536,1188651,1189552
This update for xfsprogs fixes the following issues:
- Fixes an issue when 'fstests' with 'xfs' fail. (bsc#1181309, bsc#1181299)
- xfsprogs: Split 'libhandle1' into a separate package, since nothing within xfsprogs dynamically links against it. The shared library is still required by xfsdump as a runtime dependency.
- mkfs.xfs: Fix 'ASSERT' on too-small device with stripe geometry. (bsc#1181536)
- mkfs.xfs: If either 'sunit' or 'swidth' is not zero, the other must be as well. (bsc#1085917, bsc#1181535)
- xfs_growfs: Refactor geometry reporting. (bsc#1181306)
- xfs_growfs: Allow mounted device node as argument. (bsc#1181299)
- xfs_repair: Rebuild directory when non-root leafn blocks claim block 0. (bsc#1181309)
- xfs_repair: Check plausibility of root dir pointer before trashing it. (bsc#1188651)
- xfs_bmap: Remove '-c' from manpage. (bsc#1189552)
- xfs_bmap: Do not reject '-e'. (bsc#1189552)
- Implement 'libhandle1' through ECO. (jsc#SLE-20360)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:3274-1
Released: Fri Oct 1 10:34:17 2021
Summary: Recommended update for ca-certificates-mozilla
Type: recommended
Severity: important
References: 1190858
This update for ca-certificates-mozilla fixes the following issues:
- remove one of the Letsencrypt CAs DST_Root_CA_X3.pem, as it expires
September 30th 2021 and openssl certificate chain handling does not
handle this correctly in openssl 1.0.2 and older.
(bsc#1190858)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:3298-1
Released: Wed Oct 6 16:54:52 2021
Summary: Security update for curl
Type: security
Severity: moderate
References: 1190373,1190374,CVE-2021-22946,CVE-2021-22947
This update for curl fixes the following issues:
- CVE-2021-22947: Fixed STARTTLS protocol injection via MITM (bsc#1190374).
- CVE-2021-22946: Fixed protocol downgrade required TLS bypassed (bsc#1190373).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:3318-1
Released: Wed Oct 6 19:31:19 2021
Summary: Recommended update for sudo
Type: recommended
Severity: moderate
References: 1176473,1181371
This update for sudo fixes the following issues:
- Update to sudo 1.8.27 (jsc#SLE-17083).
- Fixed special handling of ipa_hostname (bsc#1181371).
- Restore sudo ldap behavior to ignore expire dates when SUDOERS_TIMED option is not set in /etc/ldap.conf (bsc#1176473).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:3348-1
Released: Tue Oct 12 13:08:06 2021
Summary: Security update for systemd
Type: security
Severity: moderate
References: 1134353,1171962,1184994,1188018,1188063,1188291,1188713,1189480,1190234,CVE-2021-33910
This update for systemd fixes the following issues:
- CVE-2021-33910: Fixed use of strdupa() on a path (bsc#1188063).
- logind: terminate cleanly on SIGTERM/SIGINT (bsc#1188018).
- Adopting BFQ to control I/O (jsc#SLE-21032, bsc#1134353).
- Rules weren't applied to dm devices (multipath) (bsc#1188713).
- Ignore obsolete 'elevator' kernel parameter (bsc#1184994, bsc#1190234).
- Make sure the versions of both udev and systemd packages are always the same (bsc#1189480).
- Avoid error message when udev is updated due to udev being already active when the sockets are started again (bsc#1188291).
- Allow the systemd sysusers config files to be overriden during system installation (bsc#1171962).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:3382-1
Released: Tue Oct 12 14:30:17 2021
Summary: Recommended update for ca-certificates-mozilla
Type: recommended
Severity: moderate
References:
This update for ca-certificates-mozilla fixes the following issues:
- A new sub-package for minimal base containers (jsc#SLE-22162)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:3385-1
Released: Tue Oct 12 15:54:31 2021
Summary: Security update for glibc
Type: security
Severity: moderate
References: 1186489,1187911,CVE-2021-33574,CVE-2021-35942
This update for glibc fixes the following issues:
- CVE-2021-35942: wordexp: handle overflow in positional parameter number (bsc#1187911)
- CVE-2021-33574: Use __pthread_attr_copy in mq_notify (bsc#1186489)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:3411-1
Released: Wed Oct 13 10:42:25 2021
Summary: Recommended update for lvm2
Type: recommended
Severity: moderate
References: 1191019
This update for lvm2 fixes the following issues:
- Do not crash vgextend when extending VG with missing PV. (bsc#1191019)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:3412-1
Released: Wed Oct 13 10:50:33 2021
Summary: Recommended update for suse-module-tools
Type: recommended
Severity: important
References: 1189841,1190598
This update for suse-module-tools fixes the following issues:
- Fixed an issue where the queuing of secure boot certificates did not happen (bsc#1189841, bsc#1190598)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:3444-1
Released: Fri Oct 15 09:03:07 2021
Summary: Security update for rpm
Type: security
Severity: important
References: 1179416,1183543,1183545,1183632,1183659,1185299,1187670,1188548,CVE-2021-20266,CVE-2021-20271,CVE-2021-3421
This update for rpm fixes the following issues:
Security issues fixed:
- CVE-2021-3421, CVE-2021-20271, CVE-2021-20266: Multiple header check improvements (bsc#1183543, bsc#1183545, bsc#1183632)
- PGP hardening changes (bsc#1185299)
- Fixed potential access of freed mem in ndb's glue code (bsc#1179416)
Maintaince issues fixed:
- Fixed zstd detection (bsc#1187670)
- Added ndb rofs support (bsc#1188548)
- Fixed deadlock when multiple rpm processes try tp acquire the database lock (bsc#1183659)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:3447-1
Released: Fri Oct 15 09:05:12 2021
Summary: Security update for the Linux Kernel
Type: security
Severity: important
References: 1065729,1148868,1152489,1154353,1159886,1167773,1170774,1173746,1176940,1184439,1184804,1185302,1185677,1185726,1185762,1187167,1188067,1188651,1188986,1189297,1189841,1189884,1190023,1190062,1190115,1190159,1190358,1190406,1190432,1190467,1190523,1190534,1190543,1190576,1190595,1190596,1190598,1190620,1190626,1190679,1190705,1190717,1190746,1190758,1190784,1190785,1191172,1191193,1191240,1191292,CVE-2020-3702,CVE-2021-3669,CVE-2021-3744,CVE-2021-3752,CVE-2021-3764,CVE-2021-40490
The SUSE Linux Enterprise 15 SP2 kernel was updated.
The following security bugs were fixed:
- CVE-2020-3702: Fixed a bug which could be triggered with specifically timed and handcrafted traffic and cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure. (bnc#1191193)
- CVE-2021-3752: Fixed a use after free vulnerability in the Linux kernel's bluetooth module. (bsc#1190023)
- CVE-2021-40490: Fixed a race condition discovered in the ext4 subsystem that could leat to local priviledge escalation. (bnc#1190159)
- CVE-2021-3744: Fixed a bug which could allows attackers to cause a denial of service. (bsc#1189884)
- CVE-2021-3764: Fixed a bug which could allows attackers to cause a denial of service. (bsc#1190534)
- CVE-2021-3669: Fixed a bug that doesn't allow /proc/sysvipc/shm to scale with large shared memory segment counts which could lead to resource exhaustion and DoS. (bsc#1188986)
The following non-security bugs were fixed:
- ALSA: firewire-motu: fix truncated bytes in message tracepoints (git-fixes).
- apparmor: remove duplicate macro list_entry_is_head() (git-fixes).
- ASoC: fsl_micfil: register platform component before registering cpu dai (git-fixes).
- ASoC: mediatek: common: handle NULL case in suspend/resume function (git-fixes).
- ASoC: rockchip: i2s: Fix regmap_ops hang (git-fixes).
- ASoC: rockchip: i2s: Fixup config for DAIFMT_DSP_A/B (git-fixes).
- ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
- ath9k: fix OOB read ar9300_eeprom_restore_internal (git-fixes).
- ath9k: fix sleeping in atomic context (git-fixes).
- blk-mq: do not deactivate hctx if managed irq isn't used (bsc#1185762).
- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- Bluetooth: skip invalid hci_sync_conn_complete_evt (git-fixes).
- bnx2x: fix an error code in bnx2x_nic_load() (git-fixes).
- bnxt_en: Add missing DMA memory barriers (git-fixes).
- bnxt_en: Disable aRFS if running on 212 firmware (git-fixes).
- bnxt_en: Do not enable legacy TX push on older firmware (git-fixes).
- bnxt_en: Store the running firmware version code (git-fixes).
- bnxt: count Tx drops (git-fixes).
- bnxt: disable napi before canceling DIM (git-fixes).
- bnxt: do not lock the tx queue from napi poll (git-fixes).
- bnxt: make sure xmit_more + errors does not miss doorbells (git-fixes).
- btrfs: prevent rename2 from exchanging a subvol with a directory from different parents (bsc#1190626).
- clk: at91: clk-generated: Limit the requested rate to our range (git-fixes).
- clk: at91: clk-generated: pass the id of changeable parent at registration (git-fixes).
- console: consume APC, DM, DCS (git-fixes).
- cuse: fix broken release (bsc#1190596).
- cxgb4: dont touch blocked freelist bitmap after free (git-fixes).
- debugfs: Return error during {full/open}_proxy_open() on rmmod (bsc#1173746).
- devlink: Break parameter notification sequence to be before/after unload/load driver (bsc#1154353).
- dmaengine: ioat: depends on !UML (git-fixes).
- dmaengine: sprd: Add missing MODULE_DEVICE_TABLE (git-fixes).
- dmaengine: xilinx_dma: Set DMA mask for coherent APIs (git-fixes).
- docs: Fix infiniband uverbs minor number (git-fixes).
- drivers: gpu: amd: Initialize amdgpu_dm_backlight_caps object to 0 in amdgpu_dm_update_backlight_caps (git-fixes).
- drm: avoid blocking in drm_clients_info's rcu section (git-fixes).
- drm/amd/amdgpu: Update debugfs link_settings output link_rate field in hex (git-fixes).
- drm/amd/display: Fix timer_per_pixel unit error (git-fixes).
- drm/amdgpu: Fix BUG_ON assert (git-fixes).
- drm/gma500: Fix end of loop tests for list_for_each_entry (git-fixes).
- drm/nouveau/nvkm: Replace -ENOSYS with -ENODEV (git-fixes).
- drm/panfrost: Clamp lock region to Bifrost minimum (git-fixes).
- e1000e: Do not take care about recovery NVM checksum (jsc#SLE-8100).
- e1000e: Fix the max snoop/no-snoop latency for 10M (git-fixes).
- EDAC/i10nm: Fix NVDIMM detection (bsc#1152489).
- EDAC/synopsys: Fix wrong value type assignment for edac_mode (bsc#1152489).
- erofs: fix up erofs_lookup tracepoint (git-fixes).
- fbmem: do not allow too huge resolutions (git-fixes).
- fpga: machxo2-spi: Fix missing error code in machxo2_write_complete() (git-fixes).
- fpga: machxo2-spi: Return an error on failure (git-fixes).
- fuse: flush extending writes (bsc#1190595).
- fuse: truncate pagecache on atomic_o_trunc (bsc#1190705).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- gpio: uniphier: Fix void functions to remove return value (git-fixes).
- gpu: drm: amd: amdgpu: amdgpu_i2c: fix possible uninitialized-variable access in amdgpu_i2c_router_select_ddc_port() (git-fixes).
- gve: fix the wrong AdminQ buffer overflow check (bsc#1176940).
- hv_netvsc: Make netvsc/VF binding check both MAC and serial number (jsc#SLE-18779, bsc#1185726).
- hv: mana: remove netdev_lockdep_set_classes usage (jsc#SLE-18779, bsc#1185726).
- hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs (git-fixes).
- hwmon: (tmp421) fix rounding for negative values (git-fixes).
- hwmon: (tmp421) report /PVLD condition as fault (git-fixes).
- i40e: Add additional info to PHY type error (git-fixes).
- i40e: Fix firmware LLDP agent related warning (git-fixes).
- i40e: Fix log TC creation failure when max num of queues is exceeded (git-fixes).
- i40e: Fix logic of disabling queues (git-fixes).
- i40e: Fix queue-to-TC mapping on Tx (git-fixes).
- iavf: Fix ping is lost after untrusted VF had tried to change MAC (jsc#SLE-7940).
- iavf: Set RSS LUT and key in reset handle path (git-fixes).
- ibmvnic: check failover_pending in login response (bsc#1190523 ltc#194510).
- ibmvnic: Consolidate code in replenish_rx_pool() (bsc#1190758 ltc#191943).
- ibmvnic: Fix up some comments and messages (bsc#1190758 ltc#191943).
- ibmvnic: init_tx_pools move loop-invariant code (bsc#1190758 ltc#191943).
- ibmvnic: Reuse LTB when possible (bsc#1190758 ltc#191943).
- ibmvnic: Reuse rx pools when possible (bsc#1190758 ltc#191943).
- ibmvnic: Reuse tx pools when possible (bsc#1190758 ltc#191943).
- ibmvnic: Use bitmap for LTB map_ids (bsc#1190758 ltc#191943).
- ibmvnic: Use/rename local vars in init_rx_pools (bsc#1190758 ltc#191943).
- ibmvnic: Use/rename local vars in init_tx_pools (bsc#1190758 ltc#191943).
- ice: Prevent probing virtual functions (git-fixes).
- iio: dac: ad5624r: Fix incorrect handling of an optional regulator (git-fixes).
- include/linux/list.h: add a macro to test if entry is pointing to the head (git-fixes).
- iomap: Fix negative assignment to unsigned sis->pages in iomap_swapfile_activate (bsc#1190784).
- ionic: cleanly release devlink instance (bsc#1167773).
- ionic: count csum_none when offload enabled (bsc#1167773).
- ipc: remove memcg accounting for sops objects in do_semtimedop() (bsc#1190115).
- ipc/util.c: use binary search for max_idx (bsc#1159886).
- ipvs: allow connection reuse for unconfirmed conntrack (bsc#1190467).
- ipvs: avoid expiring many connections from timer (bsc#1190467).
- ipvs: Fix up kabi for expire_nodest_conn_work addition (bsc#1190467).
- ipvs: queue delayed work to expire no destination connections if expire_nodest_conn=1 (bsc#1190467).
- iwlwifi: mvm: fix a memory leak in iwl_mvm_mac_ctxt_beacon_changed (git-fixes).
- kernel-binary.spec: Check for no kernel signing certificates. Also remove unused variable.
- kernel-binary.spec: Do not fail silently when KMP is empty (bsc#1190358). Copy the code from kernel-module-subpackage that deals with empty KMPs.
- kernel-binary.spec: Do not sign kernel when no key provided (bsc#1187167 bsc#1191240 ltc#194716).
- kernel-binary.spec.in Stop templating the scriptlets for subpackages (bsc#1190358). The script part for base package case is completely separate from the part for subpackages. Remove the part for subpackages from the base package script and use the KMP scripts for subpackages instead.
- libata: fix ata_host_start() (git-fixes).
- mac80211-hwsim: fix late beacon hrtimer handling (git-fixes).
- mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug (git-fixes).
- mac80211: fix use-after-free in CCMP/GCMP RX (git-fixes).
- mac80211: limit injected vht mcs/nss in ieee80211_parse_tx_radiotap (git-fixes).
- mac80211: mesh: fix potentially unaligned access (git-fixes).
- media: cedrus: Fix SUNXI tile size calculation (git-fixes).
- media: coda: fix frame_mem_ctrl for YUV420 and YVU420 formats (git-fixes).
- media: dib8000: rewrite the init prbs logic (git-fixes).
- media: imx258: Limit the max analogue gain to 480 (git-fixes).
- media: imx258: Rectify mismatch of VTS value (git-fixes).
- media: rc-loopback: return number of emitters rather than error (git-fixes).
- media: TDA1997x: fix tda1997x_query_dv_timings() return value (git-fixes).
- media: uvc: do not do DMA on stack (git-fixes).
- media: v4l2-dv-timings.c: fix wrong condition in two for-loops (git-fixes).
- mfd: Do not use irq_create_mapping() to resolve a mapping (git-fixes).
- mlx4: Fix missing error code in mlx4_load_one() (git-fixes).
- mm: always have io_remap_pfn_range() set pgprot_decrypted() (git-fixes).
- mm/swap: consider max pages in iomap_swapfile_add_extent (bsc#1190785).
- mmc: core: Return correct emmc response in case of ioctl error (git-fixes).
- mmc: rtsx_pci: Fix long reads when clock is prescaled (git-fixes).
- mmc: sdhci-of-arasan: Check return value of non-void funtions (git-fixes).
- net: mana: Add a driver for Microsoft Azure Network Adapter (MANA) (jsc#SLE-18779, bsc#1185726).
- net: mana: Add support for EQ sharing (jsc#SLE-18779, bsc#1185726).
- net: mana: Add WARN_ON_ONCE in case of CQE read overflow (jsc#SLE-18779, bsc#1185726).
- net: mana: Fix a memory leak in an error handling path in (jsc#SLE-18779, bsc#1185726).
- net: mana: fix PCI_HYPERV dependency (jsc#SLE-18779, bsc#1185726).
- net: mana: Move NAPI from EQ to CQ (jsc#SLE-18779, bsc#1185726).
- net: mana: Prefer struct_size over open coded arithmetic (jsc#SLE-18779, bsc#1185726).
- net: mana: remove redundant initialization of variable err (jsc#SLE-18779, bsc#1185726).
- net: mana: Use int to check the return value of mana_gd_poll_cq() (jsc#SLE-18779, bsc#1185726).
- net: mana: Use struct_size() in kzalloc() (jsc#SLE-18779, bsc#1185726).
- net: qlcnic: add missed unlock in qlcnic_83xx_flash_read32 (git-fixes).
- net: sched: sch_teql: fix null-pointer dereference (bsc#1190717).
- net/mlx5: E-Switch, handle devcom events only for ports on the same device (git-fixes).
- net/mlx5: Fix flow table chaining (git-fixes).
- net/mlx5: Fix return value from tracer initialization (git-fixes).
- net/mlx5: Unload device upon firmware fatal error (git-fixes).
- net/mlx5e: Avoid creating tunnel headers for local route (git-fixes).
- net/mlx5e: Fix nullptr in mlx5e_hairpin_get_mdev() (git-fixes).
- net/mlx5e: Prohibit inner indir TIRs in IPoIB (git-fixes).
- netfilter: conntrack: do not renew entry stuck in tcp SYN_SENT state (bsc#1190062).
- nfp: update ethtool reporting of pauseframe control (git-fixes).
- NFS: change nfs_access_get_cached to only report the mask (bsc#1190746).
- NFS: do not store 'struct cred *' in struct nfs_access_entry (bsc#1190746).
- NFS: pass cred explicitly for access tests (bsc#1190746).
- nvme: avoid race in shutdown namespace removal (bsc#1188067).
- nvme: fix refcounting imbalance when all paths are down (bsc#1188067).
- parport: remove non-zero check on count (git-fixes).
- PCI: aardvark: Fix checking for PIO status (git-fixes).
- PCI: aardvark: Fix masking and unmasking legacy INTx interrupts (git-fixes).
- PCI: aardvark: Increase polling delay to 1.5s while waiting for PIO response (git-fixes).
- PCI: Add ACS quirks for Cavium multi-function devices (git-fixes).
- PCI: Add ACS quirks for NXP LX2xx0 and LX2xx2 platforms (git-fixes).
- PCI: Add AMD GPU multi-function power dependencies (git-fixes).
- PCI: ibmphp: Fix double unmap of io_mem (git-fixes).
- PCI: pci-bridge-emul: Add PCIe Root Capabilities Register (git-fixes).
- PCI: pci-bridge-emul: Fix array overruns, improve safety (git-fixes).
- PCI: pci-bridge-emul: Fix big-endian support (git-fixes).
- PCI: Restrict ASMedia ASM1062 SATA Max Payload Size Supported (git-fixes).
- PCI: Use pci_update_current_state() in pci_enable_device_flags() (git-fixes).
- PM: base: power: do not try to use non-existing RTC for storing data (git-fixes).
- PM: EM: Increase energy calculation precision (git-fixes).
- power: supply: axp288_fuel_gauge: Report register-address on readb / writeb errors (git-fixes).
- power: supply: max17042_battery: fix typo in MAx17042_TOFF (git-fixes).
- powercap: intel_rapl: add support for Sapphire Rapids (jsc#SLE-15289).
- powerpc: fix function annotations to avoid section mismatch warnings with gcc-10 (bsc#1148868).
- powerpc/drmem: Make LMB walk a bit more flexible (bsc#1190543 ltc#194523).
- powerpc/perf: Drop the case of returning 0 as instruction pointer (bsc#1065729).
- powerpc/perf: Fix crash in perf_instruction_pointer() when ppmu is not set (bsc#1065729).
- powerpc/perf: Fix the check for SIAR value (bsc#1065729).
- powerpc/perf: Use regs->nip when SIAR is zero (bsc#1065729).
- powerpc/perf: Use stack siar instead of mfspr (bsc#1065729).
- powerpc/perf: Use the address from SIAR register to set cpumode flags (bsc#1065729).
- powerpc/perf/hv-gpci: Fix counter value parsing (bsc#1065729).
- powerpc/powernv: Fix machine check reporting of async store errors (bsc#1065729).
- powerpc/pseries: Prevent free CPU ids being reused on another node (bsc#1190620 ltc#194498).
- powerpc/pseries/dlpar: use rtas_get_sensor() (bsc#1065729).
- pseries/drmem: update LMBs after LPM (bsc#1190543 ltc#194523).
- pwm: img: Do not modify HW state in .remove() callback (git-fixes).
- pwm: rockchip: Do not modify HW state in .remove() callback (git-fixes).
- pwm: stm32-lp: Do not modify HW state in .remove() callback (git-fixes).
- qlcnic: Remove redundant unlock in qlcnic_pinit_from_rom (git-fixes).
- RDMA/bnxt_re: Remove unpaired rtnl unlock in bnxt_re_dev_init() (bsc#1170774).
- Re-enable UAS for LaCie Rugged USB3-FW with fk quirk (git-fixes).
- regmap: fix page selection for noinc reads (git-fixes).
- regmap: fix page selection for noinc writes (git-fixes).
- regmap: fix the offset of register error log (git-fixes).
- Restore kabi after NFS: pass cred explicitly for access tests (bsc#1190746).
- rpm: Abolish scritplet templating (bsc#1189841). Outsource kernel-binary and KMP scriptlets to suse-module-tools. This allows fixing bugs in the scriptlets as well as defining initrd regeneration policy independent of the kernel packages.
- rpm/kernel-binary.spec: Use only non-empty certificates.
- rpm/kernel-binary.spec.in: avoid conflicting suse-release suse-release had arbitrary values in staging, we can't use it for dependencies. The filesystem one has to be enough (boo#1184804).
- rtc: rx8010: select REGMAP_I2C (git-fixes).
- rtc: tps65910: Correct driver module alias (git-fixes).
- s390/unwind: use current_frame_address() to unwind current task (bsc#1185677).
- sched/fair: Add ancestors of unthrottled undecayed cfs_rq (bsc#1191292).
- scsi: core: Add helper to return number of logical blocks in a request (bsc#1190576).
- scsi: core: Introduce the scsi_cmd_to_rq() function (bsc#1190576).
- scsi: fc: Add EDC ELS definition (bsc#1190576).
- scsi: fc: Update formal FPIN descriptor definitions (bsc#1190576).
- scsi: lpfc: Add bsg support for retrieving adapter cmf data (bsc#1190576).
- scsi: lpfc: Add cm statistics buffer support (bsc#1190576).
- scsi: lpfc: Add cmf_info sysfs entry (bsc#1190576).
- scsi: lpfc: Add cmfsync WQE support (bsc#1190576).
- scsi: lpfc: Add debugfs support for cm framework buffers (bsc#1190576).
- scsi: lpfc: Add EDC ELS support (bsc#1190576).
- scsi: lpfc: Add MIB feature enablement support (bsc#1190576).
- scsi: lpfc: Add rx monitoring statistics (bsc#1190576).
- scsi: lpfc: Add SET_HOST_DATA mbox cmd to pass date/time info to firmware (bsc#1190576).
- scsi: lpfc: Add support for cm enablement buffer (bsc#1190576).
- scsi: lpfc: Add support for maintaining the cm statistics buffer (bsc#1190576).
- scsi: lpfc: Add support for the CM framework (bsc#1190576).
- scsi: lpfc: Adjust bytes received vales during cmf timer interval (bsc#1190576).
- scsi: lpfc: Copyright updates for 14.0.0.1 patches (bsc#1190576).
- scsi: lpfc: Do not release final kref on Fport node while ABTS outstanding (bsc#1190576).
- scsi: lpfc: Do not remove ndlp on PRLI errors in P2P mode (bsc#1190576).
- scsi: lpfc: Expand FPIN and RDF receive logging (bsc#1190576).
- scsi: lpfc: Fix compilation errors on kernels with no CONFIG_DEBUG_FS (bsc#1190576).
- scsi: lpfc: Fix CPU to/from endian warnings introduced by ELS processing (bsc#1190576).
- scsi: lpfc: Fix EEH support for NVMe I/O (bsc#1190576).
- scsi: lpfc: Fix FCP I/O flush functionality for TMF routines (bsc#1190576).
- scsi: lpfc: Fix gcc -Wstringop-overread warning, again (bsc#1190576).
- scsi: lpfc: Fix hang on unload due to stuck fport node (bsc#1190576).
- scsi: lpfc: Fix I/O block after enabling managed congestion mode (bsc#1190576).
- scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq() (bsc#1190576).
- scsi: lpfc: Fix NVMe I/O failover to non-optimized path (bsc#1190576).
- scsi: lpfc: Fix premature rpi release for unsolicited TPLS and LS_RJT (bsc#1190576).
- scsi: lpfc: Fix rediscovery of tape device after LIP (bsc#1190576).
- scsi: lpfc: Fix sprintf() overflow in lpfc_display_fpin_wwpn() (bsc#1190576).
- scsi: lpfc: Improve PBDE checks during SGL processing (bsc#1190576).
- scsi: lpfc: Remove unneeded variable (bsc#1190576).
- scsi: lpfc: Update lpfc version to 14.0.0.1 (bsc#1190576).
- scsi: lpfc: Update lpfc version to 14.0.0.2 (bsc#1190576).
- scsi: lpfc: Use correct scnprintf() limit (bsc#1190576).
- scsi: lpfc: Use scsi_cmd_to_rq() instead of scsi_cmnd.request (bsc#1190576).
- scsi: lpfc: Use the proper SCSI midlayer interfaces for PI (bsc#1190576).
- scsi: lpfc: Zero CGN stats only during initial driver load and stat reset (bsc#1190576).
- scsi: scsi_devinfo: Add blacklist entry for HPE OPEN-V (bsc#1189297).
- serial: 8250_pci: make setup_port() parameters explicitly unsigned (git-fixes).
- serial: 8250: Define RX trigger levels for OxSemi 950 devices (git-fixes).
- serial: mvebu-uart: fix driver's tx_empty callback (git-fixes).
- serial: sh-sci: fix break handling for sysrq (git-fixes).
- spi: Fix tegra20 build with CONFIG_PM=n (git-fixes).
- staging: board: Fix uninitialized spinlock when attaching genpd (git-fixes).
- staging: ks7010: Fix the initialization of the 'sleep_status' structure (git-fixes).
- staging: rts5208: Fix get_ms_information() heap buffer size (git-fixes).
- thermal/core: Potential buffer overflow in thermal_build_list_of_policies() (git-fixes).
- time: Handle negative seconds correctly in timespec64_to_ns() (git-fixes).
- tty: Fix data race between tiocsti() and flush_to_ldisc() (git-fixes).
- tty: serial: jsm: hold port lock when reporting modem line changes (git-fixes).
- tty: synclink_gt, drop unneeded forward declarations (git-fixes).
- usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration (git-fixes).
- usb: dwc2: Add missing cleanups when usb_add_gadget_udc() fails (git-fixes).
- usb: dwc2: Avoid leaving the error_debugfs label unused (git-fixes).
- usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave (git-fixes).
- usb: dwc2: gadget: Fix ISOC transfer complete handling for DDMA (git-fixes).
- usb: EHCI: ehci-mv: improve error handling in mv_ehci_enable() (git-fixes).
- usb: gadget: r8a66597: fix a loop in set_feature() (git-fixes).
- usb: gadget: u_ether: fix a potential null pointer dereference (git-fixes).
- usb: host: fotg210: fix the actual_length of an iso packet (git-fixes).
- usb: host: fotg210: fix the endpoint's transactional opportunities calculation (git-fixes).
- usb: musb: musb_dsps: request_irq() after initializing musb (git-fixes).
- usb: musb: tusb6010: uninitialized data in tusb_fifo_write_unaligned() (git-fixes).
- usb: serial: cp210x: add ID for GW Instek GDM-834x Digital Multimeter (git-fixes).
- usb: serial: option: add device id for Foxconn T99W265 (git-fixes).
- usb: serial: option: add Telit LN920 compositions (git-fixes).
- usb: serial: option: remove duplicate USB device ID (git-fixes).
- usbip: give back URBs for unsent unlink requests during cleanup (git-fixes).
- usbip:vhci_hcd USB port can get stuck in the disabled state (git-fixes).
- video: fbdev: asiliantfb: Error out if 'pixclock' equals zero (git-fixes).
- video: fbdev: kyro: Error out if 'pixclock' equals zero (git-fixes).
- video: fbdev: kyro: fix a DoS bug by restricting user input (git-fixes).
- video: fbdev: riva: Error out if 'pixclock' equals zero (git-fixes).
- vmxnet3: add support for 32 Tx/Rx queues (bsc#1190406).
- vmxnet3: add support for ESP IPv6 RSS (bsc#1190406).
- vmxnet3: increase maximum configurable mtu to 9190 (bsc#1190406).
- vmxnet3: prepare for version 6 changes (bsc#1190406).
- vmxnet3: remove power of 2 limitation on the queues (bsc#1190406).
- vmxnet3: set correct hash type based on rss information (bsc#1190406).
- vmxnet3: update to version 6 (bsc#1190406).
- watchdog/sb_watchdog: fix compilation problem due to COMPILE_TEST (git-fixes).
- x86/alternatives: Teach text_poke_bp() to emulate instructions (bsc#1185302).
- x86/apic/msi: Plug non-maskable MSI affinity race (bsc#1184439).
- x86/cpu: Fix core name for Sapphire Rapids (jsc#SLE-15289).
- x86/mm: Fix kern_addr_valid() to cope with existing but not present entries (bsc#1152489).
- x86/resctrl: Fix a maybe-uninitialized build warning treated as error (bsc#1152489).
- x86/resctrl: Fix default monitoring groups reporting (bsc#1152489).
- xfs: allow mount/remount when stripe width alignment is zero (bsc#1188651).
- xfs: sync lazy sb accounting on quiesce of read-only mounts (bsc#1190679).
- xgene-v2: Fix a resource leak in the error handling path of 'xge_probe()' (git-fixes).
- xhci: Set HCD flag to defer primary roothub registration (git-fixes).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:3454-1
Released: Mon Oct 18 09:29:26 2021
Summary: Security update for krb5
Type: security
Severity: moderate
References: 1189929,CVE-2021-37750
This update for krb5 fixes the following issues:
- CVE-2021-37750: Fixed KDC null pointer dereference via a FAST inner body that lacks a server field (bsc#1189929).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:3480-1
Released: Wed Oct 20 11:24:10 2021
Summary: Recommended update for yast2-network
Type: recommended
Severity: moderate
References: 1185016,1185524,1186910,1187270,1187512,1188344,1190645,1190739,1190915,1190933
This update for yast2-network fixes the following issues:
- Don't crash when the interfaces table contains a not configured one (bnc#1190645, bsc#1190915).
- Fix the shown description using the interface friendly name when it is empty (bsc#1190933).
- Consider aliases sections as case insensitive (bsc#1190739).
- Display user defined device name in the devices overview (bnc#1190645).
- Don't crash when defined aliases in AutoYaST profile are not defined as a map (bsc#1188344).
- Support 'boot' and 'on' as aliases for the 'auto' startmode (bsc#1186910).
- Fix desktop file so the control center tooltip is translated (bsc#1187270).
- Use the linuxrc proxy settings for the HTTPS and FTP proxies (bsc#1185016).
- Don't crash at the end of installation when storing wifi configuration for NetworkManager (bsc#1185524, bsc#1187512).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:3490-1
Released: Wed Oct 20 16:31:55 2021
Summary: Security update for ncurses
Type: security
Severity: moderate
References: 1190793,CVE-2021-39537
This update for ncurses fixes the following issues:
- CVE-2021-39537: Fixed an heap-based buffer overflow in _nc_captoinfo. (bsc#1190793)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:3494-1
Released: Wed Oct 20 16:48:46 2021
Summary: Recommended update for pam
Type: recommended
Severity: moderate
References: 1190052
This update for pam fixes the following issues:
- Added pam_faillock to the set of available PAM modules. (jsc#SLE-20638)
- Added new file macros.pam on request of systemd. (bsc#1190052)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:3501-1
Released: Fri Oct 22 10:42:46 2021
Summary: Recommended update for libzypp, zypper, libsolv, protobuf
Type: recommended
Severity: moderate
References: 1186503,1186602,1187224,1187425,1187466,1187738,1187760,1188156,1188435,1189031,1190059,1190199,1190465,1190712,1190815
This update for libzypp, zypper, libsolv and protobuf fixes the following issues:
- Choice rules: treat orphaned packages as newest (bsc#1190465)
- Avoid calling 'su' to detect a too restrictive sudo user umask (bsc#1186602)
- Do not check of signatures and keys two times(redundant) (bsc#1190059)
- Rephrase vendor conflict message in case 2 packages are involved (bsc#1187760)
- Show key fpr from signature when signature check fails (bsc#1187224)
- Fix solver jobs for PTFs (bsc#1186503)
- Fix purge-kernels fails (bsc#1187738)
- Fix obs:// platform guessing for Leap (bsc#1187425)
- Make sure to keep states alives while transitioning. (bsc#1190199)
- Manpage: Improve description about patch updates(bsc#1187466)
- Manpage: Recommend the needs-rebooting command to test whether a system reboot is suggested.
- Fix kernel-*-livepatch removal in purge-kernels. (bsc#1190815)
- Fix crashes in logging code when shutting down (bsc#1189031)
- Do not download full files even if the checkExistsOnly flag is set. (bsc#1190712)
- Add need reboot/restart hint to XML install summary (bsc#1188435)
- Prompt: choose exact match if prompt options are not prefix free (bsc#1188156)
- Include libprotobuf-lite20 in products to enable parallel downloads. (jsc#ECO-2911, jsc#SLE-16862)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:3510-1
Released: Tue Oct 26 11:22:15 2021
Summary: Recommended update for pam
Type: recommended
Severity: important
References: 1191987
This update for pam fixes the following issues:
- Fixed a bad directive file which resulted in
the 'securetty' file to be installed as 'macros.pam'.
(bsc#1191987)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:3515-1
Released: Tue Oct 26 13:48:04 2021
Summary: Recommended update for suse-module-tools
Type: recommended
Severity: important
References: 1191200,1191260,1191480,1191804,1191922
This update for suse-module-tools fixes the following issues:
Update to version 15.2.15:
- Fix bad exit status in openQA. (bsc#1191922)
- Deal with existing certificates that should be de-enrolled. (bsc#1191804)
- Ignore kernel keyring for kernel certificates. (bsc#1191480)
- Print 'mokutil' output in verbose mode.
- Skip certificate scriptlet on non-UEFI systems. (bsc#1191260)
- Don't pass existing files to weak-modules2. (bsc#1191200)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:3523-1
Released: Tue Oct 26 15:40:13 2021
Summary: Security update for util-linux
Type: security
Severity: moderate
References: 1122417,1125886,1178236,1188921,CVE-2021-37600
This update for util-linux fixes the following issues:
Update to version 2.33.2 to provide seamless update from SLE12 SP5 to SLE15 SP2:
- CVE-2021-37600: Fixed an integer overflow which could lead to a buffer overflow in get_sem_elements() in sys-utils/ipcutils.c (bsc#1188921).
- agetty: Fix 8-bit processing in get_logname() (bsc#1125886).
- mount: Fix 'mount' output for net file systems (bsc#1122417).
- ipcs: Avoid overflows (bsc#1178236)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:3529-1
Released: Wed Oct 27 09:23:32 2021
Summary: Security update for pcre
Type: security
Severity: moderate
References: 1172973,1172974,CVE-2019-20838,CVE-2020-14155
This update for pcre fixes the following issues:
Update pcre to version 8.45:
- CVE-2020-14155: Fixed integer overflow via a large number after a '(?C' substring (bsc#1172974).
- CVE-2019-20838: Fixed buffer over-read in JIT compiler (bsc#1172973)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:3567-1
Released: Wed Oct 27 22:14:01 2021
Summary: Recommended update for apparmor
Type: recommended
Severity: moderate
References: 1191690
This update for apparmor fixes the following issues:
- Fixed an issue when apparmor provides python2 and python3 libraries with the same name. (bsc#1191690)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:3616-1
Released: Thu Nov 4 12:29:16 2021
Summary: Security update for binutils
Type: security
Severity: moderate
References: 1179898,1179899,1179900,1179901,1179902,1179903,1180451,1180454,1180461,1181452,1182252,1183511,1184620,1184794,CVE-2020-16590,CVE-2020-16591,CVE-2020-16592,CVE-2020-16593,CVE-2020-16598,CVE-2020-16599,CVE-2020-35448,CVE-2020-35493,CVE-2020-35496,CVE-2020-35507,CVE-2021-20197,CVE-2021-20284,CVE-2021-3487
This update for binutils fixes the following issues:
Update to binutils 2.37:
* The GNU Binutils sources now requires a C99 compiler and library to
build.
* Support for Realm Management Extension (RME) for AArch64 has been
added.
* A new linker option '-z report-relative-reloc' for x86 ELF targets
has been added to report dynamic relative relocations.
* A new linker option '-z start-stop-gc' has been added to disable
special treatment of __start_*/__stop_* references when
--gc-sections.
* A new linker options '-Bno-symbolic' has been added which will
cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
* The readelf tool has a new command line option which can be used to
specify how the numeric values of symbols are reported.
--sym-base=0|8|10|16 tells readelf to display the values in base 8,
base 10 or base 16. A sym base of 0 represents the default action
of displaying values under 10000 in base 10 and values above that in
base 16.
* A new format has been added to the nm program. Specifying
'--format=just-symbols' (or just using -j) will tell the program to
only display symbol names and nothing else.
* A new command line option '--keep-section-symbols' has been added to
objcopy and strip. This stops the removal of unused section symbols
when the file is copied. Removing these symbols saves space, but
sometimes they are needed by other tools.
* The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
supported by objcopy now make undefined symbols weak on targets that
support weak symbols.
* Readelf and objdump can now display and use the contents of .debug_sup
sections.
* Readelf and objdump will now follow links to separate debug info
files by default. This behaviour can be stopped via the use of the
new '-wN' or '--debug-dump=no-follow-links' options for readelf and
the '-WN' or '--dwarf=no-follow-links' options for objdump. Also
the old behaviour can be restored by the use of the
'--enable-follow-debug-links=no' configure time option.
The semantics of the =follow-links option have also been slightly
changed. When enabled, the option allows for the loading of symbol
tables and string tables from the separate files which can be used
to enhance the information displayed when dumping other sections,
but it does not automatically imply that information from the
separate files should be displayed.
If other debug section display options are also enabled (eg
'--debug-dump=info') then the contents of matching sections in both
the main file and the separate debuginfo file *will* be displayed.
This is because in most cases the debug section will only be present
in one of the files.
If however non-debug section display options are enabled (eg
'--sections') then the contents of matching parts of the separate
debuginfo file will *not* be displayed. This is because in most
cases the user probably only wanted to load the symbol information
from the separate debuginfo file. In order to change this behaviour
a new command line option --process-links can be used. This will
allow di0pslay options to applied to both the main file and any
separate debuginfo files.
* Nm has a new command line option: '--quiet'. This suppresses 'no
symbols' diagnostic.
Update to binutils 2.36:
New features in the Assembler:
- General:
* When setting the link order attribute of ELF sections, it is now
possible to use a numeric section index instead of symbol name.
* Added a .nop directive to generate a single no-op instruction in
a target neutral manner. This instruction does have an effect on
DWARF line number generation, if that is active.
* Removed --reduce-memory-overheads and --hash-size as gas now
uses hash tables that can be expand and shrink automatically.
- X86/x86_64:
* Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
Locker instructions.
* Support non-absolute segment values for lcall and ljmp.
* Add {disp16} pseudo prefix to x86 assembler.
* Configure with --enable-x86-used-note by default for Linux/x86.
- ARM/AArch64:
* Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
Cortex-R82, Neoverse V1, and Neoverse N2 cores.
* Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
Stack Recorder Extension) and BRBE (Branch Record Buffer
Extension) system registers.
* Add support for Armv8-R and Armv8.7-A ISA extensions.
* Add support for DSB memory nXS barrier, WFET and WFIT
instruction for Armv8.7.
* Add support for +csre feature for -march. Add CSR PDEC
instruction for CSRE feature in AArch64.
* Add support for +flagm feature for -march in Armv8.4 AArch64.
* Add support for +ls64 feature for -march in Armv8.7
AArch64. Add atomic 64-byte load/store instructions for this
feature.
* Add support for +pauth (Pointer Authentication) feature for
-march in AArch64.
New features in the Linker:
* Add --error-handling-script=<NAME> command line option to allow
a helper script to be invoked when an undefined symbol or a
missing library is encountered. This option can be suppressed
via the configure time switch: --enable-error-handling-script=no.
* Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
x86-64-{baseline|v[234]} ISA level as needed.
* Add -z unique-symbol to avoid duplicated local symbol names.
* The creation of PE format DLLs now defaults to using a more
secure set of DLL characteristics.
* The linker now deduplicates the types in .ctf sections. The new
command-line option --ctf-share-types describes how to do this:
its default value, share-unconflicted, produces the most compact
output.
* The linker now omits the 'variable section' from .ctf sections
by default, saving space. This is almost certainly what you
want unless you are working on a project that has its own
analogue of symbol tables that are not reflected in the ELF
symtabs.
New features in other binary tools:
* The ar tool's previously unused l modifier is now used for
specifying dependencies of a static library. The arguments of
this option (or --record-libdeps long form option) will be
stored verbatim in the __.LIBDEP member of the archive, which
the linker may read at link time.
* Readelf can now display the contents of LTO symbol table
sections when asked to do so via the --lto-syms command line
option.
* Readelf now accepts the -C command line option to enable the
demangling of symbol names. In addition the --demangle=<style>,
--no-demangle, --recurse-limit and --no-recurse-limit options
are also now availale.
The following security fixes are addressed by the update:
- CVE-2021-20197: Fixed a race condition which allows users to own arbitrary files (bsc#1181452).
- CVE-2021-20284: Fixed a heap-based buffer overflow in _bfd_elf_slurp_secondary_reloc_section in elf.c (bsc#1183511).
- CVE-2021-3487: Fixed a denial of service via excessive debug section size causing excessive memory consumption in bfd's dwarf2.c read_section() (bsc#1184620).
- CVE-2020-35448: Fixed a heap-based buffer over-read in bfd_getl_signed_32() in libbfd.c (bsc#1184794).
- CVE-2020-16590: Fixed a double free vulnerability in process_symbol_table() (bsc#1179898).
- CVE-2020-16591: Fixed an invalid read in process_symbol_table() (bsc#1179899).
- CVE-2020-16592: Fixed an use-after-free in bfd_hash_lookup() (bsc#1179900).
- CVE-2020-16593: Fixed a null pointer dereference in scan_unit_for_symbols() (bsc#1179901).
- CVE-2020-16598: Fixed a null pointer dereference in debug_get_real_type() (bsc#1179902).
- CVE-2020-16599: Fixed a null pointer dereference in _bfd_elf_get_symbol_version_string() (bsc#1179903)
- CVE-2020-35493: Fixed heap-based buffer overflow in bfd_pef_parse_function_stubs function in bfd/pef.c via crafted PEF file (bsc#1180451).
- CVE-2020-35496: Fixed multiple null pointer dereferences in bfd module due to not checking return value of bfd_malloc (bsc#1180454).
- CVE-2020-35507: Fixed a null pointer dereference in bfd_pef_parse_function_stubs() (bsc#1180461).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:3643-1
Released: Tue Nov 9 19:32:18 2021
Summary: Security update for binutils
Type: security
Severity: moderate
References: 1183909,1184519,1188941,1191473,1192267,CVE-2021-20294
This update for binutils fixes the following issues:
- For compatibility on old code stream that expect 'brcl 0,label' to
not be disassembled as 'jgnop label' on s390x. (bsc#1192267)
This reverts IBM zSeries HLASM support for now.
- Fixed that ppc64 optflags did not enable LTO (bsc#1188941).
- Fix empty man-pages from broken release tarball
- Fixed a memory corruption with rpath option (bsc#1191473).
- Fixed slow performance of stripping some binaries (bsc#1183909).
Security issue fixed:
- CVE-2021-20294: Fixed out-of-bounds write in print_dynamic_symbol in readelf (bnc#1184519)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:3787-1
Released: Wed Nov 24 06:00:10 2021
Summary: Recommended update for xfsprogs
Type: recommended
Severity: moderate
References: 1189983,1189984,1191500,1191566,1191675
This update for xfsprogs fixes the following issues:
- Make libhandle1 an explicit dependency in the xfsprogs-devel package (bsc#1191566)
- Remove deprecated barrier/nobarrier mount options from manual pages section 5 (bsc#1191675)
- xfs_io: include support for label command (bsc#1191500)
- xfs_quota: state command to report all three (-ugp) grace times separately (bsc#1189983)
- xfs_admin: add support for external log devices (bsc#1189984)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:3799-1
Released: Wed Nov 24 18:07:54 2021
Summary: Recommended update for gcc11
Type: recommended
Severity: moderate
References: 1187153,1187273,1188623
This update for gcc11 fixes the following issues:
The additional GNU compiler collection GCC 11 is provided:
To select these compilers install the packages:
- gcc11
- gcc-c++11
- and others with 11 prefix.
to select them for building:
- CC='gcc-11'
- CXX='g++-11'
The compiler baselibraries (libgcc_s1, libstdc++6 and others) are being replaced by the GCC 11 variants.
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:3809-1
Released: Fri Nov 26 00:31:59 2021
Summary: Recommended update for systemd
Type: recommended
Severity: moderate
References: 1189803,1190325,1190440,1190984,1191252,1192161
This update for systemd fixes the following issues:
- Add timestamp to D-Bus events to improve traceability (jsc#SLE-21862, jsc#SLE-18102, jsc#SLE-18103)
- Fix IO scheduler udev rules to address performance issues (jsc#SLE-21032, bsc#1192161)
- shutdown: Reduce log level of unmounts (bsc#1191252)
- pid1: make use of new 'prohibit_ipc' logging flag in PID 1 (bsc#1189803)
- core: rework how we connect to the bus (bsc#1190325)
- mount-util: fix fd_is_mount_point() when both the parent and directory are network fs (bsc#1190984)
- virt: detect Amazon EC2 Nitro instance (bsc#1190440)
- Several fixes for umount
- busctl: use usec granularity for the timestamp printed by the busctl monitor command
- fix unitialized fields in MountPoint in dm_list_get()
- shutdown: explicitly set a log target
- mount-util: add mount_option_mangle()
- dissect: automatically mark partitions read-only that have a read-only file system
- build-sys: require proper libmount version
- systemd-shutdown: use log_set_prohibit_ipc(true)
- rationalize interface for opening/closing logging
- pid1: when we can't log to journal, remember our fallback log target
- log: remove LOG_TARGET_SAFE pseudo log target
- log: add brief comment for log_set_open_when_needed() and log_set_always_reopen_console()
- log: add new 'prohibit_ipc' flag to logging system
- log: make log_set_upgrade_syslog_to_journal() take effect immediately
- dbus: split up bus_done() into seperate functions
- machine-id-setup: generate machine-id from DMI product ID on Amazon EC2
- virt: if we detect Xen by DMI, trust that over CPUID
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:3830-1
Released: Wed Dec 1 13:45:46 2021
Summary: Security update for glibc
Type: security
Severity: moderate
References: 1027496,1183085,CVE-2016-10228
This update for glibc fixes the following issues:
- libio: do not attempt to free wide buffers of legacy streams (bsc#1183085)
- CVE-2016-10228: Rewrite iconv option parsing to fix security issue (bsc#1027496)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:3870-1
Released: Thu Dec 2 07:11:50 2021
Summary: Recommended update for libzypp, zypper
Type: recommended
Severity: moderate
References: 1190356,1191286,1191324,1191370,1191609,1192337,1192436
This update for libzypp, zypper fixes the following issues:
libzypp:
- Check log writer before accessing it (bsc#1192337)
- Zypper should keep cached files if transaction is aborted (bsc#1190356)
- Require a minimum number of mirrors for multicurl (bsc#1191609)
- Fixed slowdowns when rlimit is too high by using procfs to detect niumber of
open file descriptors (bsc#1191324)
- Fixed zypper incomplete messages when using non English localization (bsc#1191370)
- RepoManager: Don't probe for plaindir repository if the URL schema is a plugin (bsc#1191286)
- Disable logger in the child process after fork (bsc#1192436)
zypper:
- Fixed Zypper removing a kernel explicitely pinned that uses uname -r output format as name (openSUSE/zypper#418)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:3872-1
Released: Thu Dec 2 07:25:55 2021
Summary: Recommended update for cracklib
Type: recommended
Severity: moderate
References: 1191736
This update for cracklib fixes the following issues:
- Enable build time tests (bsc#1191736)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:3883-1
Released: Thu Dec 2 11:47:07 2021
Summary: Recommended update for timezone
Type: recommended
Severity: moderate
References: 1177460
This update for timezone fixes the following issues:
Update timezone to 2021e (bsc#1177460)
- Palestine will fall back 10-29 (not 10-30) at 01:00
- Fiji suspends DST for the 2021/2022 season
- 'zic -r' marks unspecified timestamps with '-00'
- Fix a bug in 'zic -b fat' that caused old timestamps to be mishandled in 32-bit-only readers
- Refresh timezone info for china
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:3891-1
Released: Fri Dec 3 10:21:49 2021
Summary: Recommended update for keyutils
Type: recommended
Severity: moderate
References: 1029961,1113013,1187654
This update for keyutils fixes the following issues:
- Add /etc/keys/ and /usr/etc/keys/ directory (bsc#1187654)
keyutils was updated to 1.6.3 (jsc#SLE-20016):
* Revert the change notifications that were using /dev/watch_queue.
* Apply the change notifications that use pipe2(O_NOTIFICATION_PIPE).
* Allow 'keyctl supports' to retrieve raw capability data.
* Allow 'keyctl id' to turn a symbolic key ID into a numeric ID.
* Allow 'keyctl new_session' to name the keyring.
* Allow 'keyctl add/padd/etc.' to take hex-encoded data.
* Add 'keyctl watch*' to expose kernel change notifications on keys.
* Add caps for namespacing and notifications.
* Set a default TTL on keys that upcall for name resolution.
* Explicitly clear memory after it's held sensitive information.
* Various manual page fixes.
* Fix C++-related errors.
* Add support for keyctl_move().
* Add support for keyctl_capabilities().
* Make key=val list optional for various public-key ops.
* Fix system call signature for KEYCTL_PKEY_QUERY.
* Fix 'keyctl pkey_query' argument passing.
* Use keyctl_read_alloc() in dump_key_tree_aux().
* Various manual page fixes.
Updated to 1.6:
* Apply various specfile cleanups from Fedora.
* request-key: Provide a command line option to suppress helper execution.
* request-key: Find least-wildcard match rather than first match.
* Remove the dependency on MIT Kerberos.
* Fix some error messages
* keyctl_dh_compute.3: Suggest /proc/crypto for list of available hashes.
* Fix doc and comment typos.
* Add public key ops for encrypt, decrypt, sign and verify (needs linux-4.20).
* Add pkg-config support for finding libkeyutils.
* upstream isn't offering PGP signatures for the source tarballs anymore
Updated to 1.5.11 (bsc#1113013)
* Add keyring restriction support.
* Add KDF support to the Diffie-Helman function.
* DNS: Add support for AFS config files and SRV records
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:3899-1
Released: Fri Dec 3 11:27:41 2021
Summary: Security update for aaa_base
Type: security
Severity: moderate
References: 1162581,1174504,1191563,1192248
This update for aaa_base fixes the following issues:
- Allowed ping and ICMP commands without CAP_NET_RAW (bsc#1174504).
- Add $HOME/.local/bin to PATH, if it exists (bsc#1192248).
- Fixed get_kernel_version.c to work also for recent kernels on the s390/X platform (bsc#1191563).
- Support xz compressed kernel (bsc#1162581)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:3945-1
Released: Mon Dec 6 14:56:55 2021
Summary: Security update for python-Babel
Type: security
Severity: important
References: 1185768,CVE-2021-42771
This update for python-Babel fixes the following issues:
- CVE-2021-42771: Fixed relative path traversal that may lead to arbitrary locale files loading and arbitrary code execution (bsc#1185768).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:3946-1
Released: Mon Dec 6 14:57:42 2021
Summary: Security update for gmp
Type: security
Severity: moderate
References: 1192717,CVE-2021-43618
This update for gmp fixes the following issues:
- CVE-2021-43618: Fixed buffer overflow via crafted input in mpz/inp_raw.c (bsc#1192717).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:3986-1
Released: Fri Dec 10 06:09:11 2021
Summary: Recommended update for suse-module-tools
Type: recommended
Severity: moderate
References: 1187196
This update for suse-module-tools fixes the following issues:
- Blacklist isst_if_mbox_msr driver because uses hardware information based on
CPU family and model, which is too unspecific. On large systems, this causes
a lot of failing loading attempts for this driver, leading to slow or even
stalled boot (bsc#1187196)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:4013-1
Released: Mon Dec 13 13:56:44 2021
Summary: Recommended update for apparmor
Type: recommended
Severity: moderate
References: 1191690
This update for apparmor fixes the following issue:
- Fix 'Requires' of python3 module. (bsc#1191690)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:4015-1
Released: Mon Dec 13 17:16:00 2021
Summary: Security update for python3
Type: security
Severity: moderate
References: 1180125,1183374,1183858,1185588,1187338,1187668,1189241,1189287,CVE-2021-3426,CVE-2021-3733,CVE-2021-3737
This update for python3 fixes the following issues:
- CVE-2021-3737: Fixed http client infinite line reading (DoS) after a http 100. (bsc#1189241)
- CVE-2021-3733: Fixed ReDoS in urllib.request. (bsc#1189287)
- CVE-2021-3426: Fixed an information disclosure via pydoc. (bsc#1183374)
- Rebuild to get new headers, avoid building in support for stropts.h (bsc#1187338).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:4139-1
Released: Tue Dec 21 17:02:44 2021
Summary: Recommended update for systemd
Type: recommended
Severity: critical
References: 1193481,1193521
This update for systemd fixes the following issues:
- Revert 'core: rework how we connect to the bus' (bsc#1193521 bsc#1193481)
sleep-config: partitions can't be deleted, only files can
shared/sleep-config: exclude zram devices from hibernation candidates
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:4145-1
Released: Wed Dec 22 05:27:48 2021
Summary: Recommended update for openssl-1_1
Type: recommended
Severity: moderate
References: 1161276
This update for openssl-1_1 fixes the following issues:
- Remove previously applied patch because it interferes with FIPS validation (bsc#1161276)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:4154-1
Released: Wed Dec 22 11:02:38 2021
Summary: Security update for p11-kit
Type: security
Severity: important
References: 1180064,1187993,CVE-2020-29361
This update for p11-kit fixes the following issues:
- CVE-2020-29361: Fixed multiple integer overflows in rpc code (bsc#1180064)
- Add support for CKA_NSS_{SERVER,EMAIL}_DISTRUST_AFTER (bsc#1187993).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:4182-1
Released: Thu Dec 23 11:51:51 2021
Summary: Recommended update for zlib
Type: recommended
Severity: moderate
References: 1192688
This update for zlib fixes the following issues:
- Fix hardware compression incorrect result on z15 hardware (bsc#1192688)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:4187-1
Released: Thu Dec 23 15:31:00 2021
Summary: Recommended update for ceph, ceph-iscsi, nfs-ganesha
Type: recommended
Severity: moderate
References: 1164548,1177100,1183028,1190772,1192367,1192840
This update for ceph, ceph-iscsi, nfs-ganesha fixes the following issues:
- Update to 15.2.15-83-gf72054fa653:
- rebase on top of Ceph v15.2.15 tag
- mgr/mgr_module.py: CLICommand: Fix parsing of kwargs arguments. (bsc#1192840)
- re-do some downstream patches
- patches dropped:
'cephadm: use full qualified image names for cephadm'
'Switch to CaaSP v4.5 container images'
'cephadm: Update Grafana container image from 7.0.3'
* replaced by:
'cephadm: downstream-ify default container image paths'
- Update to 15.2.14-86-g25f8e6a7abf:
- (jsc#SES-704) mgr/mgr_module.py: CLICommand: Fix parsing of kwargs arguments
(fixes an issue caused by downstream commit 'pybing/mgr/mgr_module: allow
keyword arguments')(jsc#SES-704)
- Update to 3.5+1638408991.g5341b5d
+ rbd unmap image when deleting target (bsc#1190772)
+ gwcli: add error handling path for config api request (#231)
+ rbd-target-api: misc fixing for disk API (#229)
+ iscsi: raise if the 'gateway.conf' config file doesn't exist (#228)
+ iscsi: write cert/key to temp files in mode 'w' to handle strings (#227)
+ Fix the default value for gateway_conf (#226)
+ Add a strip to ListSetting.Normalize (#220, bsc#1177100)
+ Make settings mon config key store aware (#217)
+ Rename blacklist to blocklist (#216)
+ Fix gateway creation crash in python3 (#196)
+ Report tcmu-runner device status (#210)
+ Fix list access violiation when load config (#200, bsc#1183028)
+ fix delete disk error when disk owner is not specified (#206)
+ Support specified gateway config name (#207)
+ spec: added dependency on ceph-common package (#201)
- Add patch to fix getopt return value on aarch64 (bsc#1192367)
- Disable build of the XFS FSAL
- Enable FSAL_RGW again, as it turned out to be compatible with Ceph 16.x, but
needs patching from upstream. Backport upstream patch to fix version
comparison.
- Disable FSAL_RGW which is incompatible with Ceph 16.1.0
- Remove -fcommon from spec file
- Reverting changes made to fix (bsc#1164548)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:4192-1
Released: Tue Dec 28 10:39:50 2021
Summary: Security update for permissions
Type: security
Severity: moderate
References: 1174504
This update for permissions fixes the following issues:
- Update to version 20181225:
* drop ping capabilities in favor of ICMP_PROTO sockets (bsc#1174504)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2022:2-1
Released: Mon Jan 3 08:27:18 2022
Summary: Recommended update for lvm2
Type: recommended
Severity: moderate
References: 1183905,1193181
This update for lvm2 fixes the following issues:
- Fix lvconvert not taking `--stripes` option (bsc#1183905)
- Fix LVM vgimportclone not working on hardware snapshot (bsc#1193181)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2022:4-1
Released: Mon Jan 3 08:28:54 2022
Summary: Recommended update for libgcrypt
Type: recommended
Severity: moderate
References: 1193480
This update for libgcrypt fixes the following issues:
- Fix function gcry_mpi_sub_ui subtracting from negative value (bsc#1193480)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2022:70-1
Released: Thu Jan 13 15:25:27 2022
Summary: Recommended update for python-configshell-fb
Type: recommended
Severity: moderate
References:
This update for python-configshell-fb fixes the following issues:
- Upgrade to latest upstream version v1.1.29 (jsc#SLE-17360):
* setup.py: specify a version range for pyparsing
* setup.py: lets stick to pyparsing v2.4.7
* Don't warn if prefs file doesn't exist
- Update to version v1.1.28 from v1.1.27 (jsc#SLE-17360):
* version 1.1.28
* Ensure that all output reaches the client when daemonized
* Remove Epydoc markup from command messages
* Remove epydoc imports and epydoc calls
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2022:93-1
Released: Tue Jan 18 05:11:58 2022
Summary: Recommended update for openssl-1_1
Type: recommended
Severity: important
References: 1192489
This update for openssl-1_1 fixes the following issues:
- Add RSA_get0_pss_params() accessor that is used by nodejs16 and provide openssl-has-RSA_get0_pss_params (bsc#1192489)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2022:94-1
Released: Tue Jan 18 05:13:24 2022
Summary: Recommended update for rpm
Type: recommended
Severity: important
References: 1180125,1193711
This update for rpm fixes the following issues:
- Add explicit requirement on python-rpm-macros (bsc#1180125, bsc#1193711)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2022:124-1
Released: Wed Jan 19 05:03:04 2022
Summary: Recommended update for shared-mime-info
Type: recommended
Severity: moderate
References: 1191630
This update for shared-mime-info fixes the following issues:
- Fix nautilus not launching applications because all applications are not detected as
executable program but as shared library (bsc#1191630)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:141-1
Released: Thu Jan 20 13:47:16 2022
Summary: Security update for permissions
Type: security
Severity: moderate
References: 1169614
This update for permissions fixes the following issues:
- Update to version 20181225: setuid bit for cockpit session binary (bsc#1169614).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2022:154-1
Released: Mon Jan 24 07:02:02 2022
Summary: Recommended update for ceph-csi, csi-external-attacher, csi-external-provisioner, csi-external-resizer, csi-external-snapshotter, csi-node-driver-registrar, rook
Type: recommended
Severity: moderate
References:
This update for ceph-csi, csi-external-attacher, csi-external-provisioner, csi-external-resizer, csi-external-snapshotter, csi-node-driver-registrar, rook fixes the following issues:
- Update to 3.4.0
Features:
Beta:
Below features have been lifted from its Alpha support to Beta
* Snapshot creation and deletion
* Volume restore from snapshot
* Volume clone support
* Volume/PV Metrics of File Mode Volume
* Volume/PV Metrics of Block Mode Volume
Alpha:
* rbd-nbd volume mounter
Enhancement:
* Restore RBD snapshot to a different Pool
* Snapshot schedule support for RBD mirrored PVC
* Mirroring support for thick PVC
* Multi-Tenant support for vault encryption
* AmazonMetadata KMS provider support
* rbd-nbd volume healer support
* Locking enhancement for improving POD deletion performance
* Improvements in lock handling for snap and clone operations
* Better thick provisioning support
* Create CephFS subvolume with VolumeNamePrefix
* CephFS Subvolume path addition in PV object
* Consumption of go-ceph APIs for various CephFS controller and node operations.
* Resize of the RBD encrypted volume
* Better error handling for GRPC
* Golang profiling support for debugging
* Updated Kubernetes sidecar versions to the latest release
* Kubernetes dependency update to v1.21.2
* Create storageclass and secrets using helm charts
CI/E2E
* Expansion of RBD encrypted volumes
* Update and addition of new static golang tools
* Kubernetes v1.21 support
* Unit tests for SecretsKMS
* Test for Vault with ServiceAccount per Tenant
* E2E for user secret based metadata encryption
* Update rook.sh and Ceph cluster version in E2E
* Added RBD test for testing sc, secret via helm
* Update feature gates setting from minikube.sh
* Add CephFS test for sc, secret via helm
* Add e2e for static PVC without imageFeature parameter
* Make use of snapshot v1 API and client sets in e2e tests
* Validate thick-provisioned PVC-PVC cloning
* Adding retry support for various e2e failure scenarios
* Refactor KMS configuration and usage
- Removed patch ceph-csi-locking.patch (got merged upstream)
- Update to v3.3.0
* Feature
* Add command line arguments to configure leader election options (#313, @RaunakShah)
* Adds mappings for PV access modes to new CSI access modes: SINGLE_NODE_SINGLE_WRITER and SINGLE_NODE_MULTI_WRITER. (#308, @chrishenzie)
* Updates Kubernetes dependencies to v1.22.0 (#321, @chrishenzie) [SIG Storage]
* Bug or Regression
* Fix a bug that the controller can panic crash when it receives DeletedFinalStateUnknown deletion event. (#304, @Jiawei0227)
* Other (Cleanup or Flake)
* Updates container-storage-interface dependency to v1.5.0 (#312, @chrishenzie)
* Reuse the same gRPC CSI client for all CSI driver calls (#318, @yeya24)
- Update to v3.2.1
- Get rid of vendoring
- Update version of go to 1.16
- Update to v3.0.2
- Update version to 3.0.0
* Feature
* Add command line arguments to configure leader election options (#643, @RaunakShah)
* Adds mappings for PV access modes to new CSI access modes: SINGLE_NODE_SINGLE_WRITER and SINGLE_NODE_MULTI_WRITER. (#630, @chrishenzie)
* The provisioner sidecar now has an argument called controller-publish-readonly which sets the value of CSI PV spec readonly field value based on the PVC access mode. If this flag is set to true and the PVC access mode only contains the ROX access mode, the controller automatically sets PersistentVolume.spec.CSIPersistentVolumeSource.readOnly field to true. (#469, @humblec)
* Updates Kubernetes dependencies to v1.22.0 (#660, @chrishenzie) [SIG Storage]
* Updates container-storage-interface dependency to v1.5.0 (#644, @chrishenzie)
* Bug or Regression
* Fix a bug that not being able to use block device mode when enable a storage capacity tracking mode. (#635, @bells17)
* Fix a data race in cloning protection controller (#651, @tksm)
* Fix capacity information updates when topology changes. Only affected central deployment and network attached storage, not deployment on each node. This broke in v2.2.0 as part of a bug fix for capacity informer handling. (#617, @bai3shuo4)
* Fix env name from POD_NAMESPACE to NAMESPACE for capacity-ownerref-level option. (#636, @bells17)
* Fixed reporting of metrics when a migratable CSI driver is used. (#620, @jsafrane)
* Newly provisioned CSI Migration enabled PV will have 'provisioned-by' annotation set to in-tree provisioner name instead of the CSI provisioner (#646, @wongma7)
- Update version to 2.2.2
- Get rid of vendoring
- Use go 1.16 for building
- Update version to 2.0.4
- Update to version 1.3.0
* Other (Cleanup or Flake)
* Updates Kubernetes dependencies to v1.22.0 (#165, @chrishenzie) [SIG Storage]
* Updates container-storage-interface dependency to v1.5.0 (#156, @chrishenzie)
* Feature
* Adds mappings for PV access modes to new CSI access modes: SINGLE_NODE_SINGLE_WRITER and SINGLE_NODE_MULTI_WRITER. (#151, @chrishenzie)
* leader-election-lease-duration, leader-election-renew-deadline and leader-election-retry-period were added to command line arguments to configure leader election options (#158, @RaunakShah)
- Update to version 1.2.0
- Get rid of vendoring
- Push go version to 1.16
- Update to version 1.0.1
- Update to version 4.2.0
* Feature
* Snapshot APIs
* The namespace of the referenced VolumeSnapshot is printed when printing a VolumeSnapshotContent. (#535, @tsmetana)
* Snapshot Controller
* retry-interval-start and retry-interval-max arguments are added to common-controller which controls retry interval of failed volume snapshot creation and deletion. These values set the ratelimiter for snapshot and content queues. (#530, @humblec)
* Add command line arguments leader-election-lease-duration, leader-election-renew-deadline, and leader-election-retry-period to configure leader election options for the snapshot controller. (#575, @bertinatto)
* Adds an operations_in_flight metric for determining the number of snapshot operations in progress. (#519, @ggriffiths)
* Introduced 'SnapshotCreated' and 'SnapshotReady' events. (#540, @rexagod)
* CSI Snapshotter Sidecar
* retry-interval-start and retry-interval-max arguments are added to csi-snapshotter sidecar which controls retry interval of failed volume snapshot creation and deletion. These values set the ratelimiter for volumesnapshotcontent queue. (#308, @humblec)
* Add command line arguments leader-election-lease-duration, leader-election-renew-deadline, and leader-election-retry-period to configure leader election options for CSI snapshotter sidecar. (#538, @RaunakShah)
* Bug or Regression
* Snapshot Controller
* Add process_start_time_seconds metric (#569, @saikat-royc)
* Adds the leader election health check for the snapshot controller at /healthz/leader-election (#573, @ggriffiths)
* Remove kube-system namespace verification during startup and instead list volumes across all namespaces (#515, @mauriciopoppe)
* Other (Cleanup or Flake)
* Updates Kubernetes dependencies to v1.22.0 (#570, @chrishenzie) [SIG Storage]
* Updates csi-lib-utils dependency to v0.10.0 (#574, @chrishenzie)
* Updates container-storage-interface dependency to v1.5.0 (#532, @chrishenzie)
* Snapshot Validation Webhook
* Changed the webhook image from distroless/base to distroless/static. (#550, @WanzenBug)
- Update to version 4.1.1
- Get rid of vendoring
- Update go-version to 1.16
- Update to version 3.0.2
- Update to version 2.3.0
* Dockerfile.Windows args changed to ADDON_IMAGE and BASE_IMAGE (#146, @mauriciopoppe)
* Updates Kubernetes dependencies to v1.22.0 (#159, @chrishenzie) [SIG Storage]
* Updates csi-lib-utils dependency to v0.10.0 (#160, @chrishenzie)
* New running modes, the kubelet-registration-probe mode checks if node-driver-registrar kubelet plugin registration succeeded. (#152, @mauriciopoppe)
* Updates container-storage-interface dependency to v1.5.0 (#151, @chrishenzie)
- Update to version 2.2.0
* Updated runtime (Go 1.16) and dependencies (#136, @pohly)
* Update image and tag names for Windows to have separate parameters for nanoserver and servercore (#111, @jingxu97)
- Update to v1.7.7
Rook v1.7.7 is a patch release limited in scope and focusing on small feature additions and bug fixes to the Ceph operator.
* docs: Support ephemeral volumes with Ceph CSI RBD and CephFS driver (#9055, @humblec)
* core: Allow downgrade of all daemons consistently (#9098, @travisn)
* core: Reconcile once instead of multiple times after the cluster CR is edited (#9091, @leseb)
* nfs: Add pool setting CR option (#9040, @leseb)
* ceph: Trigger 'CephMonQuorumLost' alert when mon quorum is down (#9068, @aruniiird)
* rgw: Updated livenessProbe and readinessProbe (#9080, @satoru-takeuchi)
* mgr: Do not set the balancer mode on pacific (#9063, @leseb)
* helm: Add appVersion property to the charts (#9051, @travisn)
* rgw: Read tls secret hint for insecure tls (#9020, @leseb)
* ceph: Ability to set labels on the crash collector (#9044, @leseb)
* core: Treat cluster as not existing if the cleanup policy is set (#9041, @travisn)
* docs: Document failover and failback scenarios for applications (#8411, @Yuggupta27)
* ceph: Update endpoint with IP for external RGW server (#9010, @thotz)
- Combined gomod.patch and gosum.patch to vendor.patch
* Patching module-files to match the SUSE build env
- Update to v1.7.6
Rook v1.7.6 is a patch release limited in scope and focusing on small feature additions and bug fixes to the Ceph operator.
* core: only merge stderr on error (#8995, @leseb)core: only merge stderr on error (#8995, @leseb)
* nfs: remove RADOS options from CephNFS and use .nfs pool (#8501, @josephsawaya)
* csi: fix comment for the provisioner and clusterID (#8990, @Madhu-1)
* mon: Enable mon failover for the arbiter in stretch mode (#8984, @travisn)
* monitoring: fixing the queries for alerts 'CephMgrIsAbsent' and 'CephMgrIsMissingReplicas' (#8985, @aruniiird)
* osd: fix kms auto-detection when full TLS (#8867, @leseb)
* csi: add affinity to csi version check job (#8965, @Rakshith-R)
* pool: remove default value for pool compression (#8966, @leseb)
* monitoring: handle empty ceph_version in ceph_mon_metadata to avoid raising misleading alert (#8947, @GowthamShanmugam)
* nfs: remove RADOS options from CephNFS and use .nfs pool (#8501, @josephsawaya)
* osd: print the c-v output when inventory command fails (#8971, @leseb)
* helm: remove chart content not in common.yaml (#8884, @BlaineEXE)
* rgw: replace period update --commit with function (#8911, @BlaineEXE)
* rgw: fixing ClientID of log-collector for RGW instance (#8889, @parth-gr)
* mon: run ceph commands to mon with timeout (#8939, @leseb)
* osd: do not hide errors (#8933, @leseb)
* rgw: use trace logs for RGW admin HTTP info (#8937, @BlaineEXE)
- Update to v1.7.5
Rook v1.7.5 is a patch release limited in scope and focusing on small feature additions and bug fixes to the Ceph operator.
* Update csi sidecar references to the latest versions (#8820, @humblec)
* No longer install the VolumeReplication CRDs from Rook (#8845, @travisn)
* Initialize rbd block pool after creation (#8923, @Rakshith-R)
* Close stdoutPipe for the discovery daemon (#8917, @subhamkrai)
* Add documentation to recover a pod from a lost node (#8742, @subhamkrai)
* Increasing the auto-resolvable alerts delay to 15m (#8896, @aruniiird)
* Change CephAbsentMgr to use 'up' query (#8882, @aruniiird)
* Adding 'namespace' field to the needed ceph queries (#8901, @aruniiird)
* Update period if period does not exist (#8828, @BlaineEXE)
* Do not fail on KMS keys deletion (#8868, @leseb)
* Do not build all the multus args to remote exec cmd (#8860, @leseb)
* Fix external script when passing monitoring list (#8807, @leseb)
* Use insecure TLS for bucket health check (#8712, @leseb)
* Add PVC privileges to the rook-ceph-purge-osd service account (#8833, @ashangit)
* Fix the example of local PVC-based cluster (#8846, @satoru-takeuchi)
* Add signal handling for log collector (#8806, @leseb)
* Prometheus rules format changes (#8774, @aruniiird)
* Add namespace to ceph node down query (#8793, @aruniiird)
- Added gomod.patch and gosum.patch
* Patching module-files to match the SUSE build env
- Update to v1.7.4
Rook v1.7.4 is a patch release limited in scope and focusing on small feature additions and bug fixes to the Ceph operator.
* Add missing error type check to exec (#8751, @BlaineEXE)
* Raise minimum supported version of Ceph-CSI to v3.3.0 (#8803, @humblec)
* Set the Ceph v16.2.6 release as the default version (#8743, @leseb)
* Pass region to newS3agent() (#8766, @thotz)
* Remove unnecessary CephFS provisioner permission (#8739, @Madhu-1)
* Configurable csi provisioner replica count (#8801, @Madhu-1)
* Allow setting the default storageclass for a filesystem in the helm chart (#8771, @kubealex)
* Retry object health check if creation fails (#8708, @BlaineEXE)
* Use the admin socket for the mgr liveness probe (#8721, @jmolmo)
* Correct the CephFS mirroring documentation (#8732, @leseb)
* Reconcile OSD PDBs if allowed disruption is 0 (#8698, @sp98)
* Add peer spec migration to upgrade doc (#8435, @BlaineEXE)
* Fix lvm osd db device check (#8267, @lyind)
* Refactor documentation to simplify for the Ceph provider (#8693, @travisn)
* Emphasize unit tests in the development guide (#8685, @BlaineEXE)
- Update to v1.7.3
Rook Ceph v1.7.3 is a patch release limited in scope and focusing on small feature additions and bug fixes.
* Cassandra and NFS have moved to their own repos. All improvements in this repo starting from this release will only be for the Ceph storage provider. (#8619, @BlaineEXE)
* Image list for offline installation can be found in images.txt (#8596, @subhamkrai)
* Add networking.k8s.io/v1 Ingress chart compatibility (#8666, @hall)
* Modify the log info when ok to continue fails (#8675, @subhamkrai)
* Print the output on errors from ceph-volume (#8670, @leseb)
* Add quota and capabilities configuration for CephObjectStore users (#8211, @thotz)
* Fix pool deletion when uninstalling a multus cluster configuration (#8659, @leseb)
* Use node externalIP if no internalIP defined (#8653, @JrCs)
* Fix CephOSDCriticallyFull and CephOSDNearFull monitoring alert queries (#8668, @Muyan0828)
* Fix CephMonQuorumAtRisk monitoring alert query (#8652, @anmolsachan)
* Allow an even number of mons (#8636, @travisn)
* Create a pod disruption budget for the Ceph mgr deployment when two mgrs are requested (#8593, @parth-gr)
* Fix error message in UpdateNodeStatus (#8629, @hiroyaonoe)
* Avoid multiple reconciles of ceph cluster due to the ipv4 default setting (#8638, @leseb)
* Avoid duplicate ownerReferences (#8615, @YZ775)
* Auto grow OSDs size on PVCs based on prometheus metrics (#8078, @parth-gr)
* External cluster configuration script fixed for backward compatibility with python2 (#8623, @aruniiird)
* Fix vault kv secret engine auto-detection (#8618, @leseb)
* Add ClusterID and PoolID mappings between local and peer cluster (#8626, @sp98)
* Set the filesystem status when mirroring is not enabled (#8609, @travisn)
- Update to v1.7.2
Rook v1.7.2 s a patch release limited in scope and focusing on small feature additions and bug fixes.
* Ceph
* Merge toleration for osd/prepareOSD pod if specified both places (#8566, @subhamkrai)
* Fix panic when recreating the csidriver object (#8582, @Madhu-1)
* Build with latest golang v1.16.7 (#8540, @BlaineEXE)
* Do not check ok-to-stop when OSDs are in CLBO (#8583, @leseb)
* Convert util.NewSet() to sets.NewString() (#8584, @parth-gr)
* Add support for update() from lib-bucket-provisioner (#8514, @thotz)
* Signal handling with context (#8441, @leseb)
* Make storage device config nullable (#8552, @BlaineEXE)
* Allow K8s version check on prerelease versions (#8561, @subhamkrai)
* Add permissions to rook-ceph-mgr role for osd removal in rook orchestator (#8568, @josephsawaya)
* Use serviceAccountName as the key in ceph csi templates (#8546, @humblec)
* Consolidate the calls to set mon config (#8590, @travisn)
* NFS
* Upgrade nfs-ganesha to 3.5 version (#8534, @kam1kaze)
- Update to v1.7.1
Rook v1.7.1 s a patch release limited in scope and focusing on small feature additions and bug fixes.
* Ceph
* Update Ceph CSI version to v3.4.0 (#8425, @Madhu-1)
* Add ability to specify the CA bundle for RGW (#8492, @degorenko)
* Remove unused mon timeout cli flags (#8489, @leseb)
* Add an option to enable/disable merge all placement (#8381, @subhamkrai)
* Refuse to failover the arbiter mon on stretch clusters (#8520, @travisn)
* Improve topology example of cluster on local pvc (#8491, @satoru-takeuchi)
- Update to v1.7.0
v1.7.0 is a minor release with features primarily for the Ceph operator.
K8s Version Support
Kubernetes supported versions: 1.11 and newer.
Upgrade Guides
If you are running a previous Rook version, please see the corresponding storage provider upgrade guide:
* Ceph
Breaking Changes
Ceph
Clusters with multiple filesystems will need to update their Ceph version to Pacific. The Operator configuration option ROOK_ALLOW_MULTIPLE_FILESYSTEMS has been removed in favor of simply verifying the Ceph version is at least Pacific where multiple filesystems are fully supported.
Features
Ceph
* Official Ceph images are now being published to quay.io. To pick up the latest version of Ceph, update your
CephCLuster spec field image must be updated to point to quay. See the example cluster.
* Add support for creating Hybrid Storage Pools.
* A hybrid storage pool creates a CRUSH rule for choosing the primary OSD for high performance
devices (ssd, nvme, etc) and the remaining OSD for low performance devices (hdd).
* See the design and Ceph docs for more details.
* Add support CephFS mirroring peer configuration. See the configuration for more details.
* Add support for Kubernetes TLS secrets for referring TLS certs needed for the Ceph RGW server.
* Stretch clusters are considered stable
* Ceph v16.2.5 or greater is required for stretch clusters
* The use of peer secret names in CephRBDMirror is deprecated. Please use CephBlockPool CR to configure peer secret names and import peers. See the mirroring section in the CephBlockPool spec for more details.
* Add user data protection when deleting Rook-Ceph Custom Resources. See the design for detailed information.
* A CephCluster will not be deleted if there are any other Rook-Ceph Custom resources referencing
it with the assumption that they are using the underlying Ceph cluster.
* A CephObjectStore will not be deleted if there is a bucket present. In addition to protection
from deletion when users have data in the store, this implicitly protects these resources from
being deleted when there is a referencing ObjectBucketClaim present.
Cassandra
* CRDs converted from v1beta1 to v1
* Schema is generated from the internal types for more complete validation
* Minimum K8s version for the v1 CRDs is K8s 1.16
NFS
* CRDs converted from v1beta1 to v1
* Schema is generated from the internal types for more complete validation
* Minimum K8s version for the v1 CRDs is K8s 1.16
- Update to v1.6.10
Rook v1.6.10 is a patch release limited in scope and focusing on small feature additions and bug fixes.
* Ceph
* Reconcile OSD PDB if allowed disruptions are 0 (#8698)
* Merge tolerations for the OSDs if specified in both all and osd placement (#8630)
* External cluster script compatibility with python2 (#8623)
* Do not check ok-to-stop when OSDs are in CLBO (#8583)
* Fix panic when recreating the csidriver object (#8582)
- Update to v1.6.9
Rook v1.6.9 s a patch release limited in scope and focusing on small feature additions and bug fixes.
* Ceph
* Make storage device config nullable (#8552)
* Build with latest golang v1.16.7 (#8540)
* Refuse to failover the arbiter mon on stretch clusters (#8520)
* Add an option to enable/disable merge all placement (#8381)
* Update ancillary monitoring resources (#8406)
* Updated mon health check goroutine for reconfiguring patch values (#8370)
* Releases for v1.6 are now based on Github actions instead of Jenkins (#8525 #8564)
- Update to v1.6.8
Rook v1.6.8 is a patch release limited in scope and focusing on small feature additions and bug fixes.
* Ceph
* Re-enable lvm mode for OSDs on disks. See details to know if your OSDs are affected by unexpected partitions (#8319)
* Update test to watch for v1 cronjob instead of v1beta1 (#8356)
* Update PodDisruptionBudget from v1beta1 to v1 (#7977)
* Add support for tls certs via k8s tls secrets for rgw (#8243)
* Create correct ClusterRoleBinding for helm chart in namespace other than rook-ceph (#8344)
* If two mgrs, ensure services are reconciled with the cluster (#8330)
* Proxy rbd commands when multus is enabled (#8339)
* Proxy ceph command when multus is configured (#8272)
* Ensure OSD keyring exists at OSD pod start (#8155)
* Add an example of a pvc-based ceph cluster on bare metal (#7969)
* Mount /dev for the OSD daemon on lv-backed pvc (#8304)
* Add ceph cluster context for lib bucket provisioning reconcile (#8310)
* Create PDBs for all rgw and cephfs (#8301)
* Always rehydrate the access and secret keys (#8286)
* Fix PDB of RGW instances (#8274)
* Ability to disable pool mirroring (#8215)
* Fetch rgw port from the CephObjectStore the OBC (#8244)
* Enable debug logging for adminops client log level is debug (#8208)
* Update blockPoolChannel before starting the mirror monitoring (#8222)
* Scaling down nfs deployment was failing (#8250)
- removed update-tarball.sh (_service file will be used instead)
- Update to v1.6.7
Rook v1.6.7 is a patch release limited in scope and focusing on small feature additions and bug fixes.
* Ceph
* Ignore atari partitions for OSDs when scanning disks.
This is a partial fix for multiple OSDs being created unexpectedly per disk,
causing OSD corruption. See details to know if your OSDs are affected (#8195)
* Update CSIDriver object from betav1 to v1 (#8029)
* Retry cluster reconcile immediately after cancellation (#8237)
* Avoid operator resource over-usage when configuring RGW pools and memory limits are applied (#8238)
* Remove k8s.io/kubernetes as a code dependency (#7913)
* Silence harmless errors if the operator is still initializing (#8227)
* If MDS resource limits are not set, assign mds_cache_memory_limit = resource requests * 0.8 (#8180)
* Do not require rgw instances spec for external clusters (#8219)
* Add tls support to external rgw endpoint (#8092)
* Stop overwriting shared livenessProbe when overridden (#8206)
* Update cluster-on-pvc example for proper OSD scheduling (#8199)
- Update to v1.6.6
Rook v1.6.6 is a patch release limited in scope and focusing on small feature additions and bug fixes.
* Ceph
* Update csi sidecar images to latest release (#8125)
* Update csi node-driver-registrar to latest release (#8190)
* Evict a mon if colocated with another mon (#8181)
* Enable logging in legacy LVM OSD daemons (#8175)
* Do not leak key encryption key to the log (#8173)
* Read and validate CSI params in a goroutine (#8140)
* Only require rgw-admin-ops user when an RGW endpoint is provided (#8164)
* Avoid unnecessary OSD restarts when multus is configured (#8142)
* Use cacert if no client cert/key are present for OSD encryption with Vault (#8157)
* Mons in stretch cluster should be assigned to a node when using dataDirHostPath (#8147)
* Support cronjob v1 for newer versions of K8s to avoid deprecated v1beta1 (#8114)
* Initialise httpclient for bucketchecker and objectstoreuse (#8139)
* Activate osd container should use correct host path for config (#8137)
* Set device class for already present osd deployments (#8134)
* No need for --force when creating filesystem (#8130)
* Expose enableCSIHostNetwork correctly in the helm chart (#8074)
* Add RBAC for mgr to create service monitor (#8118)
* Update operator internal controller runtime and k8s reference version (#8087)
- Update to v1.6.5
Rook v1.6.5 is a patch release limited in scope and focusing on small feature additions and bug fixes.
We are happy to announce the availability of a Helm chart to configure the CephCluster CR.
Please try it out and share feedback! We would like to declare it stable in v1.7.
* Ceph
* Experimental Helm chart for CephClusters (#7778)
* Disable insecure global id if no insecure clients are detected. If insecure clients are still required, see these instructions. (#7746)
* Enable host networking by default in the CSI driver due to issues with client IO hangs when the driver restarts (#8102)
* Add a disaster recovery guide for an accidentally deleted CephCluster CR (#8040)
* Do not fail prepareOSD job if devices are not passed (#8098)
* Ensure MDS and RGW are upgraded anytime the ceph image changes (#8060)
* External cluster config enables v1 address type when enabling v2 (#8083)
* Create object pools in parallel for faster object store reconcile (#8082)
* Fix detection of delete event reconciliation (#8086)
* Use RGW admin API for s3 user management (#7998)
- Update to v1.6.4
Rook v1.6.4 is a patch release limited in scope and focusing on small feature additions and bug fixes.
* Ceph
* Support for separate tolerations and affinities for rbd and cephfs CSI drivers (#8006)
* Update ceph version to 15.2.13 (#8004)
* External cluster upgrades fix for CRD schema (#8042)
* Build with golang 1.16 instead of 1.15 (#7945)
* Retry starting CSI drivers on initial failure (#8020)
* During uninstall stop monitoring rbd mirroring before cleanup (#8031)
* Update the backend path for RGW transit engine (#8008)
* If reducing mon count only remove one extra mon per health check (#8011)
* Parse radosgw-admin json properly for internal commands (#8000)
* Expand OSD PVCs only if the underlying storage class allow expansion (#8001)
* Allow the operator log level to be changed dynamically (#7976)
* Pin experimental volume replication to release-v0.1 branch (#7985)
* Remove '--site-name' arg when creating bootstrap peer token (#7986)
* Do not configure external metric endpoint if not present (#7974)
* Helm chart to allow multiple filesystems (#7930)
* Rehydrate the bootstrap peer token secret on monitor changes (#7935)
- Update to v1.6.3
Rook v1.6.3 is a patch release limited in scope and focusing on small feature additions and bug fixes.
* Ceph
* Ensure correct devices are started for OSDs after node restart (#7951)
* Write reconcile results to events on the CephCluster CR (#7222)
* Updated dashboard ingress example for networking v1 (#7933)
* Remove obsolete gateway type setting in object store CRD (#7919)
* Support specifying only public network or only cluster network or both (#7546)
* Generate same operator deployment for OKD as OCP (#7898)
* Ensure correct hostpath lock for OSD integrity (#7886)
* Improve resilience of mon failover if operator is restarted during failover (#7884)
* Disallow overriding the liveness probe handler function (#7889)
* Actively update the service endpoint for external mgr (#7875)
* Remove obsolete CSI statefulset template path vars from K8s 1.13 (#7877)
* Create crash collector pods after mon secret created (#7867)
* OSD controller only updates PDBs during node drains instead of any OSD down event (#7726)
* Allow heap dump generation when logCollector sidecar is not running (#7847)
* Add nullable to object gateway settings (#7857)
- Update to v1.6.2
Rook v1.6.2 is a patch release limited in scope and focusing on small feature additions and bug fixes.
* Ceph
* Set base Ceph operator image and example deployments to v16.2.2 (#7829)
* Update snapshot APIs from v1beta1 to v1 (#7711)
* Documentation for creating static PVs (#7782)
* Allow setting primary-affinity for the OSD (#7807)
* Remove unneeded debug log statements (#7526)
* Preserve volume claim template annotations during upgrade (#7835)
* Allow re-creating erasure coded pool with different settings (#7820)
* Double mon failover timeout during a node drain (#7801)
* Remove unused volumesource schema from CephCluster CRD (#7813)
* Set the device class on raw mode osds (#7815)
* External cluster schema fix to allow not setting mons (#7789)
* Add phase to the CephFilesystem CRD (#7752)
* Generate full schema for volumeClaimTemplates in the CephCluster CRD (#7631)
* Automate upgrades for the MDS daemon to properly scale down and scale up (#7445)
* Add Vault KMS support for object stores (#7385)
* Ensure object store endpoint is initialized when creating an object user (#7633)
* Support for OBC operations when RGW is configured with TLS (#7764)
* Preserve the OSD topology affinity during upgrade for clusters on PVCs (#7759)
* Unify timeouts for various Ceph commands (#7719)
* Allow setting annotations on RGW service (#7598)
* Expand PVC size of mon daemons if requested (#7715)
- Update to v1.6.1
Rook v1.6.1 is a patch release limited in scope and focusing on small feature additions and bug fixes.
* Ceph
* Disable host networking by default in the CSI plugin with option to enable (#7356)
* Fix the schema for erasure-coded pools so replication size is not required (#7662)
* Improve node watcher for adding new OSDs (#7568)
* Operator base image updated to v16.2.1 (#7713)
* Deployment examples updated to Ceph v15.2.11 (#7733)
* Update Ceph-CSI to v3.3.1 (#7724)
* Allow any device class for the OSDs in a pool instead of restricting the schema (#7718)
* Fix metadata OSDs for Ceph Pacific (#7703)
* Allow setting the initial CRUSH weight for an OSD (#7472)
* Fix object store health check in case SSL is enabled (#7331)
* Upgrades now ensure latest config flags are set for MDS and RGW (#7681)
* Suppress noisy RGW log entry for radosgw-admin commands (#7663)
- Update to v1.6.0
* Major Themes
v1.6.0 is a minor release with features primarily for the Ceph operator.
* K8s Version Support
Kubernetes supported versions: 1.11 and newer
* Upgrade Guides
If you are running a previous Rook version, please see the corresponding storage provider upgrade guide:
* Ceph
* Breaking Changes
* Removed Storage Providers
Each storage provider is unique and requires time and attention to properly develop and support.
After much discussion with the community, we have decided to remove three storage providers from
Rook in order to focus our efforts on storage providers that have active community support.
See the project status for more information. These storage providers have been removed:
* CockroachDB
* EdgeFS
* YugabyteDB
* Ceph
Support for creating OSDs via Drive Groups was removed. Please refer to the Ceph upgrade guide for migration instructions.
* Features
* Ceph
Ceph Pacific (v16) support, including features such as:
Multiple Ceph Filesystems
Networking dual stack
CephFilesystemMirror CRD to support mirroring of CephFS volumes with Pacific
Ceph CSI Driver
CSI v3.3.0 driver enabled by default
Volume Replication Controller for improved RBD replication support
Multus support
GRPC metrics disabled by default
Ceph RGW
Extended the support of vault KMS configuration
Scale with multiple daemons with a single deployment instead of a separate deployment for each rgw daemon
OSDs:
LVM is no longer used to provision OSDs as of Nautilus 14.2.14 Octopus 15.2.9, and Pacific 16.2.0, simplifying the OSDs on raw devices, except for encrypted OSDs and multiple OSDs per device.
More efficient updates for multiple OSDs at the same time (in the same failure domain) to speed up upgrades for larger Ceph clusters
Multiple Ceph mgr daemons are supported for stretch clusters and other clusters where HA of the mgr is critical (set count: 2 under mgr in the CephCluster CR)
Pod Disruption Budgets (PDBs) are enabled by default for Mon, RGW, MDS, and OSD daemons. See the disruption management settings.
Monitor failover can be disabled, for scenarios where maintenance is planned and automatic mon failover is not desired
CephClient CRD has been converted to use the controller-runtime library
The following package changes have been done:
- aaa_base-84.87+git20180409.04c9dae-3.52.1 updated
- binutils-2.37-7.26.1 updated
- ca-certificates-mozilla-2.44-21.1 updated
- ceph-base-15.2.15.83+gf72054fa653-3.28.1 updated
- ceph-common-15.2.15.83+gf72054fa653-3.28.1 updated
- ceph-grafana-dashboards-15.2.15.83+gf72054fa653-3.28.1 updated
- ceph-iscsi-3.5+1638408991.g5341b5d-3.6.2 updated
- ceph-mds-15.2.15.83+gf72054fa653-3.28.1 updated
- ceph-mgr-cephadm-15.2.15.83+gf72054fa653-3.28.1 updated
- ceph-mgr-dashboard-15.2.15.83+gf72054fa653-3.28.1 updated
- ceph-mgr-modules-core-15.2.15.83+gf72054fa653-3.28.1 updated
- ceph-mgr-rook-15.2.15.83+gf72054fa653-3.28.1 updated
- ceph-mgr-15.2.15.83+gf72054fa653-3.28.1 updated
- ceph-mon-15.2.15.83+gf72054fa653-3.28.1 updated
- ceph-osd-15.2.15.83+gf72054fa653-3.28.1 updated
- ceph-prometheus-alerts-15.2.15.83+gf72054fa653-3.28.1 updated
- ceph-radosgw-15.2.15.83+gf72054fa653-3.28.1 updated
- cephadm-15.2.15.83+gf72054fa653-3.28.1 updated
- ceph-15.2.15.83+gf72054fa653-3.28.1 updated
- cpio-2.12-3.9.1 updated
- cracklib-dict-small-2.9.7-11.6.1 updated
- cracklib-2.9.7-11.6.1 updated
- dbus-1-1.12.2-8.11.2 updated
- device-mapper-1.02.163-8.39.1 updated
- file-magic-5.32-7.14.1 updated
- glibc-locale-base-2.26-13.62.1 updated
- glibc-2.26-13.62.1 updated
- keyutils-1.6.3-5.6.1 updated
- kmod-compat-25-6.10.1 updated
- kmod-25-6.10.1 updated
- krb5-1.16.3-3.24.1 updated
- libapparmor1-2.13.4-3.11.1 updated
- libaugeas0-1.10.1-3.3.1 updated
- libblkid1-2.33.2-4.16.1 updated
- libcephfs2-15.2.15.83+gf72054fa653-3.28.1 updated
- libcrack2-2.9.7-11.6.1 updated
- libctf-nobfd0-2.37-7.26.1 updated
- libctf0-2.37-7.26.1 updated
- libcurl4-7.66.0-4.27.1 updated
- libdbus-1-3-1.12.2-8.11.2 updated
- libdevmapper-event1_03-1.02.163-8.39.1 updated
- libdevmapper1_03-1.02.163-8.39.1 updated
- libfdisk1-2.33.2-4.16.1 updated
- libganesha_nfsd3_3-3.3+git0.39e0cf712-3.3.1 updated
- libgcc_s1-11.2.1+git610-1.3.9 updated
- libgcrypt20-hmac-1.8.2-8.42.1 updated
- libgcrypt20-1.8.2-8.42.1 updated
- libgmp10-6.1.2-4.9.1 updated
- libkeyutils1-1.6.3-5.6.1 updated
- libkmod2-25-6.10.1 updated
- libldap-2_4-2-2.4.46-9.58.1 updated
- libldap-data-2.4.46-9.58.1 updated
- libltdl7-2.4.6-3.4.1 updated
- liblvm2cmd2_03-2.03.05-8.39.1 updated
- libmagic1-5.32-7.14.1 updated
- libmount1-2.33.2-4.16.1 updated
- libncurses6-6.1-5.9.1 updated
- libntirpc3_3-3.3+git0.39e0cf712-3.3.1 updated
- libopenssl1_1-hmac-1.1.1d-11.38.1 updated
- libopenssl1_1-1.1.1d-11.38.1 updated
- libp11-kit0-0.23.2-4.13.1 updated
- libpcre1-8.45-20.10.1 updated
- libprotobuf-lite20-3.9.2-4.9.1 added
- libpython3_6m1_0-3.6.15-3.91.3 updated
- librados2-15.2.15.83+gf72054fa653-3.28.1 updated
- librbd1-15.2.15.83+gf72054fa653-3.28.1 updated
- librgw2-15.2.15.83+gf72054fa653-3.28.1 updated
- libsmartcols1-2.33.2-4.16.1 updated
- libsolv-tools-0.7.20-9.2 updated
- libstdc++6-11.2.1+git610-1.3.9 updated
- libsystemd0-234-24.102.1 updated
- libudev1-234-24.102.1 updated
- libuuid1-2.33.2-4.16.1 updated
- libz1-1.2.11-3.24.1 updated
- libzypp-17.28.8-20.1 updated
- lvm2-2.03.05-8.39.1 updated
- ncurses-utils-6.1-5.9.1 updated
- nfs-ganesha-ceph-3.3+git0.39e0cf712-3.3.1 updated
- nfs-ganesha-rados-grace-3.3+git0.39e0cf712-3.3.1 updated
- nfs-ganesha-rados-urls-3.3+git0.39e0cf712-3.3.1 updated
- nfs-ganesha-rgw-3.3+git0.39e0cf712-3.3.1 updated
- nfs-ganesha-3.3+git0.39e0cf712-3.3.1 updated
- openssl-1_1-1.1.1d-11.38.1 updated
- p11-kit-tools-0.23.2-4.13.1 updated
- p11-kit-0.23.2-4.13.1 updated
- pam-1.3.0-6.50.1 updated
- patterns-base-fips-20200124-4.12.1 added
- permissions-20181225-23.12.1 updated
- python3-Babel-2.8.0-3.3.1 updated
- python3-asn1crypto-0.24.0-3.2.1 updated
- python3-base-3.6.15-3.91.3 updated
- python3-cachetools-4.1.0-3.2.1 updated
- python3-ceph-argparse-15.2.15.83+gf72054fa653-3.28.1 updated
- python3-ceph-common-15.2.15.83+gf72054fa653-3.28.1 updated
- python3-cephfs-15.2.15.83+gf72054fa653-3.28.1 updated
- python3-cffi-1.13.2-3.2.5 updated
- python3-configshell-fb-1.1.29-3.3.1 updated
- python3-cryptography-2.8-10.1 updated
- python3-curses-3.6.15-3.91.4 updated
- python3-dbus-python-1.2.16-6.3.1 updated
- python3-google-auth-1.5.1-3.4.1 updated
- python3-kubernetes-8.0.1-3.5.1 updated
- python3-oauth2client-gce-4.1.2-3.2.1 updated
- python3-oauth2client-4.1.2-3.2.1 updated
- python3-pyOpenSSL-17.5.0-8.3.1 updated
- python3-pyasn1-0.4.2-3.2.1 updated
- python3-pycparser-2.17-3.2.1 updated
- python3-pytz-2021.1-6.7.1 updated
- python3-rados-15.2.15.83+gf72054fa653-3.28.1 updated
- python3-rbd-15.2.15.83+gf72054fa653-3.28.1 updated
- python3-rgw-15.2.15.83+gf72054fa653-3.28.1 updated
- python3-urllib3-1.25.10-9.14.1 updated
- python3-3.6.15-3.91.4 updated
- rbd-mirror-15.2.15.83+gf72054fa653-3.28.1 updated
- rook-k8s-yaml-1.7.7+git0.4ec49a23b-3.24.3 updated
- rook-rookflex-1.7.7+git0.4ec49a23b-3.24.3 updated
- rook-1.7.7+git0.4ec49a23b-3.24.3 updated
- rpm-4.14.1-22.7.1 updated
- shared-mime-info-1.12-3.3.1 updated
- sudo-1.8.27-4.21.4 updated
- suse-module-tools-15.2.16-4.12.1 updated
- systemd-234-24.102.1 updated
- terminfo-base-6.1-5.9.1 updated
- timezone-2021e-75.4.1 updated
- udev-234-24.102.1 updated
- util-linux-2.33.2-4.16.1 updated
- xfsprogs-4.15.0-4.52.1 updated
- zypper-1.14.50-21.1 updated
- container:ceph-image-1.0.0-6.93 updated
- file-5.32-7.11.2 removed
- python-rpm-macros-20200207.5feb6c1-3.11.1 removed
More information about the sle-updates
mailing list