Security update for ceph, deepsea
This update for ceph, deepsea fixes the following issues: - ceph was updated to 14.2.20-402-g6aa76c6815: * CVE-2021-20288: Fixed unauthorized global_id reuse (bsc#1183074). * CVE-2020-25678: Do not add sensitive information in Ceph log files (bsc#1178905). * CVE-2020-27839: Use secure cookies to store JWT Token (bsc#1179997). * mgr/dashboard: prometheus alerting: add some leeway for package drops and errors (bsc#1145463) * mon: have 'mon stat' output json as well (bsc#1174466) * rpm: ceph-mgr-dashboard recommends python3-saml on SUSE (bsc#1177200) * mgr/dashboard: Display a warning message in Dashboard when debug mode is enabled (bsc#1178235) * rgw: cls/user: set from_index for reset stats calls (bsc#1178837) * mgr/dashboard: Disable TLS 1.0 and 1.1 (bsc#1178860) * bluestore: provide a different name for fallback allocator (bsc#1180118) * test/run-cli-tests: use cram from github (bsc#1181378) * mgr/dashboard: fix 'Python2 Cookie module import fails on Python3' (bsc#1183487) * common: make ms_bind_msgr2 default to 'false' (bsc#1180594) - deapsea was updated to 0.9.35 * osd: add method to zap simple osds (bsc#1178657, bsc#1178216) * upgrade to cephadm: fix Drive Group generation (bsc#1181665) * Rework config change detection to handle global.conf correctly (bsc#1181183) * Use -i to pass credentials to `ceph dashboard` commands (bsc#1183600)
02 / AFFECTED SOFTWARE
Affected packages
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
This update for ceph, deepsea fixes the following issues: - ceph was updated to 14.2.20-402-g6aa76c6815: * CVE-2021-20288: Fixed unauthorized global_id reuse (bsc#1183074). * CVE-2020-25678: Do not add sensitive information in Ceph log files (bsc#1178905). * CVE-2020-27839: Use secure cookies to store JWT Token (bsc#1179997). * mgr/dashboard: prometheus alerting: add some leeway for package drops and errors (bsc#1145463) * mon: have 'mon stat' output json as well (bsc#1174466) * rpm: ceph-mgr-dashboard recommends python3-saml on SUSE (bsc#1177200) * mgr/dashboard: Display a warning message in Dashboard when debug mode is enabled (bsc#1178235) * rgw: cls/user: set from_index for reset stats calls (bsc#1178837) * mgr/dashboard: Disable TLS 1.0 and 1.1 (bsc#1178860) * bluestore: provide a different name for fallback allocator (bsc#1180118) * test/run-cli-tests: use cram from github (bsc#1181378) * mgr/dashboard: fix 'Python2 Cookie module import fails on Python3' (bsc#1183487) * common: make ms_bind_msgr2 default to 'false' (bsc#1180594) - deapsea was updated to 0.9.35 * osd: add method to zap simple osds (bsc#1178657, bsc#1178216) * upgrade to cephadm: fix Drive Group generation (bsc#1181665) * Rework config change detection to handle global.conf correctly (bsc#1181183) * Use -i to pass credentials to `ceph dashboard` commands (bsc#1183600)
05 / REFERENCES
Further evidence
- https://bugzilla.suse.com/1145463
- https://bugzilla.suse.com/1174466
- https://bugzilla.suse.com/1177200
- https://bugzilla.suse.com/1178016
- https://bugzilla.suse.com/1178216
- https://bugzilla.suse.com/1178235
- https://bugzilla.suse.com/1178657
- https://bugzilla.suse.com/1178837
- https://bugzilla.suse.com/1178860
- https://bugzilla.suse.com/1178905
- https://bugzilla.suse.com/1179997
- https://bugzilla.suse.com/1180118
- https://bugzilla.suse.com/1180594
- https://bugzilla.suse.com/1181183
- https://bugzilla.suse.com/1181378
- https://bugzilla.suse.com/1181665
- https://bugzilla.suse.com/1183074
- https://bugzilla.suse.com/1183487
- https://bugzilla.suse.com/1183600
- https://www.suse.com/security/cve/CVE-2020-25678
- https://www.suse.com/security/cve/CVE-2020-27839
- https://www.suse.com/security/cve/CVE-2021-20288
- https://www.suse.com/support/update/announcement/2021/suse-su-20211472-1/