doc: 17.2.2 Release notes

Signed-off-by: David Galloway <dgallowa@redhat.com>

diff --git a/doc/releases/index.rst b/doc/releases/index.rst
index dbb5a6f2969394aefb36cf3fa893f9db202f7d07..bd0db5818956b773e2347b229266bbb27d49e8de 100644 (file)
--- a/doc/releases/index.rst
+++ b/doc/releases/index.rst
@@ -64,6 +64,7 @@ Release timeline
 .. _Quincy: quincy
 .. _17.2.0: quincy#v17-2-0-quincy
 .. _17.2.1: quincy#v17-2-1-quincy
+.. _17.2.2: quincy#v17-2-2-quincy
 
 .. _Pacific: pacific
 .. _16.2.9: pacific#v16-2-9-pacific

diff --git a/doc/releases/quincy.rst b/doc/releases/quincy.rst
index 15cffb0081df2eabe65e852a73d0c57a7ea5bd0a..31b64c6b55ac33ecd62d47c49a8eebc07c59c41b 100644 (file)
--- a/doc/releases/quincy.rst
+++ b/doc/releases/quincy.rst
@@ -5,6 +5,41 @@ Quincy
 Quincy is the 17th stable release of Ceph.  It is named after Squidward
 Quincy Tentacles from Spongebob Squarepants.
 
+v17.2.2 Quincy
+==============
+
+This is a hotfix release that resolves two security flaws.
+
+Notable Changes
+---------------
+* Users who were running OpenStack Manila to export native CephFS, who
+  upgraded their Ceph cluster from Nautilus (or earlier) to a later
+  major version, were vulnerable to an attack by malicious users. The
+  vulnerability allowed users to obtain access to arbitrary portions of
+  the CephFS filesystem hierarchy, instead of being properly restricted
+  to their own subvolumes. The vulnerability is due to a bug in the
+  "volumes" plugin in Ceph Manager. This plugin is responsible for
+  managing Ceph File System subvolumes which are used by OpenStack
+  Manila services as a way to provide shares to Manila users.
+  
+  With this hotfix, the vulnerability is fixed. Administrators who are
+  concerned they may have been impacted should audit the CephX keys in
+  their cluster for proper path restrictions.
+  
+  Again, this vulnerability only impacts OpenStack Manila clusters which
+  provided native CephFS access to their users.
+
+* A regression made it possible to dereference a null pointer for
+  for s3website requests that don't refer to a bucket resulting in an RGW
+  segfault.
+
+Changelog
+---------
+* mgr/volumes: Fix subvolume discover during upgrade (:ref:`CVE-2022-0670`, Kotresh HR)
+* mgr/volumes: V2 Fix for test_subvolume_retain_snapshot_invalid_recreate (:ref:`CVE-2022-0670`, Kotresh HR)
+* qa: validate subvolume discover on upgrade (Kotresh HR)
+* rgw: s3website check for bucket before retargeting (Seena Fallah)
+
 v17.2.1 Quincy
 ==============
 

diff --git a/doc/releases/releases.yml b/doc/releases/releases.yml
index 7fb1ed68124c363e2c506321963c127314d0e1c1..ed05b2d9a4d247bb9f94d6830c7cc8f20948c85e 100644 (file)
--- a/doc/releases/releases.yml
+++ b/doc/releases/releases.yml
@@ -17,9 +17,10 @@ releases:
     releases:
       - version: 17.2.0
         released: 2022-04-19
-    releases:
       - version: 17.2.1
         released: 2022-06-23
+      - version: 17.2.2
+        released: 2022-07-21
 
   pacific:
     target_eol: 2023-06-01