From 252b1e419b76d116abcf155ac9bd03a9cbea4baf Mon Sep 17 00:00:00 2001 From: Zac Dover Date: Tue, 11 Oct 2022 00:15:11 +1000 Subject: [PATCH] doc/releases: improve grammar in pacific.rst This commit accepts the grammar suggestions that were made by Cole Mitchell in https://github.com/ceph/ceph/pull/48404. Signed-off-by: Zac Dover (cherry picked from commit 560d7590fdf66ef3827203bc7c5725f167a1a7b2) --- doc/architecture.rst | 2 +- doc/rados/operations/crush-map-edits.rst | 2 +- doc/rados/operations/crush-map.rst | 3 +- doc/releases/pacific.rst | 383 +++++++++++++++++++++++ doc/security/CVE-2022-0670.rst | 43 +++ doc/security/cves.rst | 134 ++++---- 6 files changed, 498 insertions(+), 69 deletions(-) create mode 100644 doc/security/CVE-2022-0670.rst diff --git a/doc/architecture.rst b/doc/architecture.rst index c7efe6d14c29d..7d3fb703a9051 100644 --- a/doc/architecture.rst +++ b/doc/architecture.rst @@ -1625,7 +1625,7 @@ instance for high availability. .. _Monitoring OSDs and PGs: ../rados/operations/monitoring-osd-pg .. _Heartbeats: ../rados/configuration/mon-osd-interaction .. _Monitoring OSDs: ../rados/operations/monitoring-osd-pg/#monitoring-osds -.. _CRUSH - Controlled, Scalable, Decentralized Placement of Replicated Data: https://ceph.com/wp-content/uploads/2016/08/weil-crush-sc06.pdf +.. _CRUSH - Controlled, Scalable, Decentralized Placement of Replicated Data: https://ceph.io/assets/pdfs/weil-crush-sc06.pdf .. _Data Scrubbing: ../rados/configuration/osd-config-ref#scrubbing .. _Report Peering Failure: ../rados/configuration/mon-osd-interaction#osds-report-peering-failure .. _Troubleshooting Peering Failure: ../rados/troubleshooting/troubleshooting-pg#placement-group-down-peering-failure diff --git a/doc/rados/operations/crush-map-edits.rst b/doc/rados/operations/crush-map-edits.rst index 612ce65746d64..5eed48210fd3e 100644 --- a/doc/rados/operations/crush-map-edits.rst +++ b/doc/rados/operations/crush-map-edits.rst @@ -740,4 +740,4 @@ Further, as noted above, be careful running old versions of the ``ceph-osd`` daemon after reverting to legacy values as the feature bit is not perfectly enforced. -.. _CRUSH - Controlled, Scalable, Decentralized Placement of Replicated Data: https://ceph.com/wp-content/uploads/2016/08/weil-crush-sc06.pdf +.. _CRUSH - Controlled, Scalable, Decentralized Placement of Replicated Data: https://ceph.io/assets/pdfs/weil-crush-sc06.pdf diff --git a/doc/rados/operations/crush-map.rst b/doc/rados/operations/crush-map.rst index 792bbcdf219ed..7458ace428f21 100644 --- a/doc/rados/operations/crush-map.rst +++ b/doc/rados/operations/crush-map.rst @@ -953,8 +953,7 @@ release notes and documentation carefully before changing the profile on a running cluster, and consider throttling recovery/backfill parameters to limit the impact of a bolus of backfill. - -.. _CRUSH - Controlled, Scalable, Decentralized Placement of Replicated Data: https://ceph.com/wp-content/uploads/2016/08/weil-crush-sc06.pdf +.. _CRUSH - Controlled, Scalable, Decentralized Placement of Replicated Data: https://ceph.io/assets/pdfs/weil-crush-sc06.pdf Primary Affinity diff --git a/doc/releases/pacific.rst b/doc/releases/pacific.rst index 5394545476fe4..38017ef7153fd 100644 --- a/doc/releases/pacific.rst +++ b/doc/releases/pacific.rst @@ -2,6 +2,389 @@ Pacific ======= +v16.2.10 Pacific +================ + +This is a hotfix release that resolves two security flaws. + +Notable Changes +--------------- +* Users who were running OpenStack Manila to export native CephFS and who + upgraded their Ceph cluster from Nautilus (or earlier) to a later + major version were vulnerable to an attack by malicious users. The + vulnerability allowed users to obtain access to arbitrary portions of + the CephFS filesystem hierarchy instead of being properly restricted + to their own subvolumes. The vulnerability is due to a bug in the + "volumes" plugin in Ceph Manager. This plugin is responsible for + managing Ceph File System subvolumes, which are used by OpenStack + Manila services as a way to provide shares to Manila users. + + With this hotfix, the vulnerability is fixed. Administrators who are + concerned they may have been impacted should audit the CephX keys in + their cluster for proper path restrictions. + + Again, this vulnerability impacts only OpenStack Manila clusters that + provided native CephFS access to their users. + +* A regression made it possible to dereference a null pointer for + s3website requests that don't refer to a bucket resulting in an RGW + segfault. + +Changelog +--------- +* mgr/volumes: Fix subvolume discover during upgrade (:ref:`CVE-2022-0670`, Kotresh HR) +* mgr/volumes: V2 Fix for test_subvolume_retain_snapshot_invalid_recreate (:ref:`CVE-2022-0670`, Kotresh HR) +* qa: validate subvolume discover on upgrade (Kotresh HR) +* rgw: s3website check for bucket before retargeting (Seena Fallah) + +v16.2.9 Pacific +=============== + +This is a hotfix release in the Pacific series to address a bug in 16.2.8 that could cause MGRs to deadlock. See https://tracker.ceph.com/issues/55687. + +Changelog +--------- + +* mgr/ActivePyModules.cc: fix cases where GIL is held while attempting to lock mutex (`pr#46302 `_, Cory Snyder) + +v16.2.8 Pacific +=============== + +This is the eighth backport release in the Pacific series. + +Notable Changes +--------------- + +* MON/MGR: Pools can now be created with `--bulk` flag. Any pools created with `bulk` + will use a profile of the `pg_autoscaler` that provides more performance from the start. + However, any pools created without the `--bulk` flag will remain using it's old behavior + by default. For more details, see: + + https://docs.ceph.com/en/latest/rados/operations/placement-groups/ + +* MGR: The pg_autoscaler can now be turned `on` and `off` globally + with the `noautoscale` flag. By default this flag is unset and + the default pg_autoscale mode remains the same. + For more details, see: + + https://docs.ceph.com/en/latest/rados/operations/placement-groups/ + +* A health warning will now be reported if the ``require-osd-release`` flag is not + set to the appropriate release after a cluster upgrade. + +* CephFS: Upgrading Ceph Metadata Servers when using multiple active MDSs requires + ensuring no pending stray entries which are directories are present for active + ranks except rank 0. + +Changelog +--------- + +* [Revert] bluestore: set upper and lower bounds on rocksdb omap iterators (`pr#46092 `_, Neha Ojha) +* admin/doc-requirements: bump sphinx to 4.4.0 (`pr#45876 `_, Kefu Chai) +* auth,mon: don't log "unable to find a keyring" error when key is given (`pr#43313 `_, Ilya Dryomov) +* backport nbd cookie support (`pr#45582 `_, Prasanna Kumar Kalever) +* backport of monitoring related PRs (`pr#45980 `_, Pere Diaz Bou, Travis Nielsen, Aashish Sharma, Nizamudeen A, Arthur Outhenin-Chalandre) +* bluestore: set upper and lower bounds on rocksdb omap iterators (`pr#45963 `_, Cory Snyder) +* build: Add some debugging messages (`pr#45753 `_, David Galloway) +* build: install-deps failing in docker build (`pr#45849 `_, Nizamudeen A, Ernesto Puerta) +* ceph-fuse: perform cleanup if test_dentry_handling failed (`pr#45351 `_, Nikhilkumar Shelke) +* ceph-volume: abort when passed devices have partitions (`pr#45146 `_, Guillaume Abrioux) +* ceph-volume: don't use MultiLogger in find_executable_on_host() (`pr#44701 `_, Guillaume Abrioux) +* ceph-volume: fix error 'KeyError' with inventory (`pr#44884 `_, Guillaume Abrioux) +* ceph-volume: fix regression introcuded via #43536 (`pr#44644 `_, Guillaume Abrioux) +* ceph-volume: fix tags dict output in `lvm list` (`pr#44767 `_, Guillaume Abrioux) +* ceph-volume: honour osd_dmcrypt_key_size option (`pr#44973 `_, Guillaume Abrioux) +* ceph-volume: human_readable_size() refactor (`pr#44209 `_, Guillaume Abrioux) +* ceph-volume: improve mpath devices support (`pr#44789 `_, Guillaume Abrioux) +* ceph-volume: make it possible to skip needs_root() (`pr#44319 `_, Guillaume Abrioux) +* ceph-volume: show RBD devices as not available (`pr#44708 `_, Michael Fritch) +* ceph/admin: s/master/main (`pr#45596 `_, Zac Dover) +* Cephadm Pacific Batch Backport April (`pr#45919 `_, Adam King, Teoman ONAY, Redouane Kachach, Lukas Mayer, Melissa Li) +* Cephadm Pacific Batch Backport March (`pr#45716 `_, Adam King, Redouane Kachach, Matan Breizman, wangyunqing) +* cephadm/ceph-volume: do not use lvm binary in containers (`pr#43954 `_, Guillaume Abrioux, Sage Weil) +* cephadm: _parse_ipv6_route: Fix parsing ifs w/o route (`pr#44877 `_, Sebastian Wagner) +* cephadm: add shared_ceph_folder opt to ceph-volume subcommand (`pr#44880 `_, Guillaume Abrioux) +* cephadm: check if cephadm is root after cli is parsed (`pr#44634 `_, John Mulligan) +* cephadm: chown the prometheus data dir during redeploy (`pr#45046 `_, Michael Fritch) +* cephadm: deal with ambiguity within normalize_image_digest (`pr#44632 `_, Sebastian Wagner) +* cephadm: fix broken telemetry documentation link (`pr#45803 `_, Laura Flores) +* cephadm: infer the default container image during pull (`pr#45569 `_, Michael Fritch) +* cephadm: make extract_uid_gid errors more readable (`pr#44528 `_, Sebastian Wagner) +* cephadm: November batch 2 (`pr#44446 `_, Sage Weil, Adam King, Sebastian Wagner, Melissa Li, Michael Fritch, Guillaume Abrioux) +* cephadm: pass `CEPH_VOLUME_SKIP_RESTORECON=yes` (backport) (`pr#44248 `_, Guillaume Abrioux) +* cephadm: preserve `authorized_keys` file during upgrade (`pr#45355 `_, Michael Fritch) +* cephadm: Remove containers pids-limit (`pr#45580 `_, Ilya Dryomov, Teoman ONAY) +* cephadm: revert pids limit (`pr#45936 `_, Adam King) +* cephadm: validate that the constructed YumDnf baseurl is usable (`pr#44882 `_, John Mulligan) +* cls/journal: skip disconnected clients when calculating min_commit_position (`pr#44690 `_, Mykola Golub) +* cls/rbd: GroupSnapshotNamespace comparator violates ordering rules (`pr#45075 `_, Ilya Dryomov) +* cmake/modules: always use the python3 specified in command line (`pr#45967 `_, Kefu Chai) +* cmake: pass RTE_DEVEL_BUILD=n when building dpdk (`pr#45262 `_, Kefu Chai) +* common/PriorityCache: low perf counters priorities for submodules (`pr#44175 `_, Igor Fedotov) +* common: avoid pthread_mutex_unlock twice (`pr#45464 `_, Dai Zhiwei) +* common: fix FTBFS due to dout & need_dynamic on GCC-12 (`pr#45373 `_, Radoslaw Zarzynski) +* common: fix missing name in PriorityCache perf counters (`pr#45588 `_, Laura Flores) +* common: replace BitVector::NoInitAllocator with wrapper struct (`pr#45179 `_, Casey Bodley) +* crush: Fix segfault in update_from_hook (`pr#44897 `_, Adam Kupczyk) +* doc/cephadm: Add CentOS Stream install instructions (`pr#44996 `_, Patrick C. F. Ernzer) +* doc/cephadm: Co-location of daemons (`pr#44879 `_, Sebastian Wagner) +* doc/cephadm: Doc backport (`pr#44525 `_, Foad Lind, Sebastian Wagner) +* doc/cephadm: improve the development doc a bit (`pr#44636 `_, Radoslaw Zarzynski) +* doc/cephadm: remove duplicate deployment scenario section (`pr#44660 `_, Melissa Li) +* doc/dev: s/repostory/repository/ (really) (`pr#45789 `_, Zac Dover) +* doc/start: add testing support information (`pr#45989 `_, Zac Dover) +* doc/start: include A. D'Atri's hardware-recs recs (`pr#45298 `_, Zac Dover) +* doc/start: remove journal info from hardware recs (`pr#45123 `_, Zac Dover) +* doc/start: remove osd stub from hardware recs (`pr#45316 `_, Zac Dover) +* doc: prerequisites fix for cephFS mount (`pr#44272 `_, Nikhilkumar Shelke) +* doc: Use older mistune (`pr#44226 `_, David Galloway) +* Enable autotune for osd_memory_target on bootstrap (`pr#44633 `_, Melissa Li) +* krbd: return error when no initial monitor address found (`pr#45003 `_, Burt Holzman) +* librados: check latest osdmap on ENOENT in pool_reverse_lookup() (`pr#45586 `_, Ilya Dryomov) +* librbd/cache/pwl: misc backports (`pr#44199 `_, Jianpeng Ma, Jason Dillaman) +* librbd: diff-iterate reports incorrect offsets in fast-diff mode (`pr#44547 `_, Ilya Dryomov) +* librbd: fix use-after-free on ictx in list_descendants() (`pr#44999 `_, Ilya Dryomov, Wang ShuaiChao) +* librbd: fix various memory leaks (`pr#44998 `_, Or Ozeri) +* librbd: make diff-iterate in fast-diff mode sort and merge reported extents (`pr#45638 `_, Ilya Dryomov) +* librbd: readv/writev fix iovecs length computation overflow (`pr#45561 `_, Jonas Pfefferle) +* librbd: restore diff-iterate include_parent functionality in fast-diff mode (`pr#44594 `_, Ilya Dryomov) +* librgw: make rgw file handle versioned (`pr#45495 `_, Xuehan Xu) +* librgw: treat empty root path as "/" on mount (`pr#43968 `_, Matt Benjamin) +* mds,client: add new getvxattr op (`pr#45487 `_, Milind Changire) +* mds: add mds_dir_max_entries config option (`pr#44512 `_, Yongseok Oh) +* mds: directly return just after responding the link request (`pr#44620 `_, Xiubo Li) +* mds: dump tree '/' when the path is empty (`pr#44622 `_, Xiubo Li) +* mds: ensure that we send the btime in cap messages (`pr#45163 `_, Jeff Layton) +* mds: fails to reintegrate strays if destdn's directory is full (ENOSPC) (`pr#44513 `_, Patrick Donnelly) +* mds: fix seg fault in expire_recursive (`pr#45099 `_, 胡玮文) +* mds: ignore unknown client op when tracking op latency (`pr#44975 `_, Venky Shankar) +* mds: kill session when mds do ms_handle_remote_reset (`issue#53911 `_, `pr#45100 `_, YunfeiGuan) +* mds: mds_oft_prefetch_dirfrags default to false (`pr#45016 `_, Dan van der Ster) +* mds: opening connection to up:replay/up:creating daemon causes message drop (`pr#44296 `_, Patrick Donnelly) +* mds: PurgeQueue.cc fix for 32bit compilation (`pr#44168 `_, Duncan Bellamy) +* mds: recursive scrub does not trigger stray reintegration (`pr#44514 `_, Patrick Donnelly) +* mds: remove the duplicated or incorrect respond (`pr#44623 `_, Xiubo Li) +* mds: reset heartbeat in each MDSContext complete() (`pr#44551 `_, Xiubo Li) +* mgr/autoscaler: Introduce noautoscale flag (`pr#44540 `_, Kamoltat) +* mgr/cephadm/iscsi: use `mon_command` in `post_remove` instead of `check_mon_command` (`pr#44830 `_, Melissa Li) +* mgr/cephadm: Add client.admin keyring when upgrading from older version (`pr#44625 `_, Sebastian Wagner) +* mgr/cephadm: add keep-alive requests to ssh connections (`pr#45632 `_, Adam King) +* mgr/cephadm: Add snmp-gateway service support (`pr#44529 `_, Sebastian Wagner, Paul Cuzner) +* mgr/cephadm: allow miscellaneous container args at service level (`pr#44829 `_, Adam King) +* mgr/cephadm: auto-enable mirroring module when deploying service (`pr#44661 `_, John Mulligan) +* mgr/cephadm: avoid repeated calls to get_module_option (`pr#44535 `_, Sage Weil) +* mgr/cephadm: block draining last _admin host (`pr#45229 `_, Adam King) +* mgr/cephadm: block removing last instance of _admin label (`pr#45231 `_, Adam King) +* mgr/cephadm: Delete ceph.target if last cluster (`pr#45228 `_, Redouane Kachach) +* mgr/cephadm: extend extra_container_args to other service types (`pr#45234 `_, Adam King) +* mgr/cephadm: fix 'cephadm osd activate' on existing osd devices (`pr#44627 `_, Sage Weil) +* mgr/cephadm: fix 'mgr/cephadm: spec.virtual_ip param should be used by the ingress daemon (`pr#44628 `_, Guillaume Abrioux, Francesco Pantano, Sebastian Wagner) +* mgr/cephadm: Fix count for OSDs with OSD specs (`pr#44629 `_, Sebastian Wagner) +* mgr/cephadm: fix minor grammar nit in Dry-Runs message (`pr#44637 `_, James McClune) +* mgr/cephadm: fix tcmu-runner cephadm_stray_daemon (`pr#44630 `_, Melissa Li) +* mgr/cephadm: Fix test_facts (`pr#44530 `_, Sebastian Wagner) +* mgr/cephadm: less log noise when config checks fail (`pr#44526 `_, Sage Weil) +* mgr/cephadm: nfs migration: avoid port conflicts (`pr#44631 `_, Sebastian Wagner) +* mgr/cephadm: Show an error when invalid format (`pr#45226 `_, Redouane Kachach) +* mgr/cephadm: store contianer registry credentials in config-key (`pr#44658 `_, Daniel Pivonka) +* mgr/cephadm: try to get FQDN for configuration files (`pr#45620 `_, Tatjana Dehler) +* mgr/cephadm: update monitoring stack versions (`pr#45940 `_, Aashish Sharma, Ernesto Puerta) +* mgr/cephadm: validating service_id for MDS (`pr#45227 `_, Redouane Kachach) +* mgr/dashboard: "Please expand your cluster first" shouldn't be shown if cluster is already meaningfully running (`pr#45044 `_, Volker Theile) +* mgr/dashboard: add test coverage for API docs (SwaggerUI) (`pr#44533 `_, Alfonso Martínez) +* mgr/dashboard: avoid tooltip if disk_usage=null and fast-diff enabled (`pr#44149 `_, Avan Thakkar) +* mgr/dashboard: cephadm e2e job improvements (`pr#44938 `_, Nizamudeen A, Alfonso Martínez) +* mgr/dashboard: cephadm e2e job: improvements (`pr#44382 `_, Alfonso Martínez) +* mgr/dashboard: change privacy protocol field from required to optional (`pr#45052 `_, Avan Thakkar) +* mgr/dashboard: Cluster Expansion - Review Section: fixes and improvements (`pr#44389 `_, Aashish Sharma) +* mgr/dashboard: Compare values of MTU alert by device (`pr#45813 `_, Aashish Sharma, Patrick Seidensal) +* mgr/dashboard: dashboard does not show degraded objects if they are less than 0.5% under "Dashboard->Capacity->Objects block (`pr#44091 `_, Aashish Sharma) +* mgr/dashboard: dashboard turns telemetry off when configuring report (`pr#45111 `_, Sarthak0702, Aaryan Porwal) +* mgr/dashboard: datatable in Cluster Host page hides wrong column on selection (`pr#45861 `_, Sarthak0702) +* mgr/dashboard: Directories Menu Can't Use on Ceph File System Dashboard (`pr#45028 `_, Sarthak0702) +* mgr/dashboard: extend daemon actions to host details (`pr#45721 `_, Nizamudeen A) +* mgr/dashboard: fix api test issue with pip (`pr#45880 `_, Ernesto Puerta) +* mgr/dashboard: fix frontend deps' vulnerabilities (`pr#44297 `_, Alfonso Martínez) +* mgr/dashboard: fix Grafana OSD/host panels (`pr#44775 `_, Patrick Seidensal) +* mgr/dashboard: fix orchestrator/02-hosts-inventory.e2e failure (`pr#44467 `_, Nizamudeen A) +* mgr/dashboard: fix timeout error in dashboard cephadm e2e job (`pr#44468 `_, Nizamudeen A) +* mgr/dashboard: fix white screen on Safari (`pr#45301 `_, 胡玮文) +* mgr/dashboard: fix: get SMART data from single-daemon device (`pr#44597 `_, Alfonso Martínez) +* mgr/dashboard: highlight the search text in cluster logs (`pr#45678 `_, Sarthak0702) +* mgr/dashboard: Implement drain host functionality in dashboard (`pr#44376 `_, Nizamudeen A) +* mgr/dashboard: Improve notifications for osd nearfull, full (`pr#44876 `_, Aashish Sharma) +* mgr/dashboard: Imrove error message of '/api/grafana/validation' API endpoint (`pr#45956 `_, Volker Theile) +* mgr/dashboard: introduce HAProxy metrics for RGW (`pr#44273 `_, Avan Thakkar) +* mgr/dashboard: introduce separate front-end component for API docs (`pr#44400 `_, Aashish Sharma) +* mgr/dashboard: Language dropdown box is partly hidden on login page (`pr#45618 `_, Volker Theile) +* mgr/dashboard: monitoring:Implement BlueStore onode hit/miss counters into the dashboard (`pr#44650 `_, Aashish Sharma) +* mgr/dashboard: NFS non-existent files cleanup (`pr#44046 `_, Alfonso Martínez) +* mgr/dashboard: NFS pages shows 'Page not found' (`pr#45723 `_, Volker Theile) +* mgr/dashboard: Notification banners at the top of the UI have fixed height (`pr#44756 `_, Nizamudeen A, Waad AlKhoury) +* mgr/dashboard: perform daemon actions (`pr#45203 `_, Pere Diaz Bou) +* mgr/dashboard: Pull latest translations from Transifex (`pr#45418 `_, Volker Theile) +* mgr/dashboard: Refactoring dashboard cephadm checks (`pr#44652 `_, Nizamudeen A) +* mgr/dashboard: RGW users and buckets tables are empty if the selected gateway is down (`pr#45868 `_, Volker Theile) +* mgr/dashboard: run-backend-api-tests.sh: Older setuptools (`pr#44377 `_, David Galloway) +* mgr/dashboard: set appropriate baseline branch for applitools (`pr#44935 `_, Nizamudeen A) +* mgr/dashboard: support snmp-gateway service creation from UI (`pr#44977 `_, Avan Thakkar) +* mgr/dashboard: Table columns hiding fix (`issue#51119 `_, `pr#45725 `_, Daniel Persson) +* mgr/dashboard: Update Angular version to 12 (`pr#44534 `_, Ernesto Puerta, Nizamudeen A) +* mgr/dashboard: upgrade Cypress to the latest stable version (`pr#44086 `_, Sage Weil, Alfonso Martínez) +* mgr/dashboard: use -f for npm ci to skip fsevents error (`pr#44105 `_, Duncan Bellamy) +* mgr/devicehealth: fix missing timezone from time delta calculation (`pr#44325 `_, Yaarit Hatuka) +* mgr/devicehealth: skip null pages when extracting wear level (`pr#45151 `_, Yaarit Hatuka) +* mgr/nfs: allow dynamic update of cephfs nfs export (`pr#45543 `_, Ramana Raja) +* mgr/nfs: support managing exports without orchestration enabled (`pr#45508 `_, John Mulligan) +* mgr/orchestrator: add filtering and count option for orch host ls (`pr#44531 `_, Adam King) +* mgr/prometheus: Added `avail_raw` field for Pools DF Prometheus mgr module (`pr#45236 `_, Konstantin Shalygin) +* mgr/prometheus: define module options for standby (`pr#44205 `_, Sage Weil) +* mgr/prometheus: expose ceph healthchecks as metrics (`pr#44480 `_, Paul Cuzner, Sebastian Wagner) +* mgr/prometheus: Fix metric types from gauge to counter (`pr#43187 `_, Patrick Seidensal) +* mgr/prometheus: Fix the per method stats exported (`pr#44146 `_, Paul Cuzner) +* mgr/prometheus: Make prometheus standby behaviour configurable (`pr#43897 `_, Roland Sommer) +* mgr/rbd_support: cast pool_id from int to str when collecting LevelSpec (`pr#45532 `_, Ilya Dryomov) +* mgr/rbd_support: fix schedule remove (`pr#45005 `_, Sunny Kumar) +* mgr/snap_schedule: backports (`pr#45906 `_, Venky Shankar, Milind Changire) +* mgr/stats: exception handling for ceph fs perf stats command (`pr#44516 `_, Nikhilkumar Shelke) +* mgr/telemetry: fix waiting for mgr to warm up (`pr#45773 `_, Yaarit Hatuka) +* mgr/volumes: A few mgr volumes pacific backports (`pr#45205 `_, Kotresh HR) +* mgr/volumes: Subvolume removal and clone failure fixes (`pr#42932 `_, Kotresh HR) +* mgr/volumes: the 'mode' should honor idempotent subvolume creation (`pr#45474 `_, Nikhilkumar Shelke) +* mgr: Fix ceph_daemon label in ceph_rgw\_\* metrics (`pr#44885 `_, Benoît Knecht) +* mgr: fix locking for MetadataUpdate::finish (`pr#44212 `_, Sage Weil) +* mgr: TTL Cache in mgr module (`pr#44750 `_, Waad AlKhoury, Pere Diaz Bou) +* mgr: various fixes for mgr scalability (`pr#44869 `_, Neha Ojha, Sage Weil) +* mon/MDSMonitor: sanity assert when inline data turned on in MDSMap from v16.2.4 -> v16.2.[567] (`pr#44910 `_, Patrick Donnelly) +* mon/MgrStatMonitor: do not spam subscribers (mgr) with service_map (`pr#44721 `_, Sage Weil) +* mon/MonCommands.h: fix target_size_ratio range (`pr#45397 `_, Kamoltat) +* mon/OSDMonitor: avoid null dereference if stats are not available (`pr#44698 `_, Josh Durgin) +* mon: Abort device health when device not found (`pr#44959 `_, Benoît Knecht) +* mon: do not quickly mark mds laggy when MON_DOWN (`pr#43698 `_, Sage Weil, Patrick Donnelly) +* mon: Omit MANY_OBJECTS_PER_PG warning when autoscaler is on (`pr#45152 `_, Christopher Hoffman) +* mon: osd pool create with --bulk flag (`pr#44847 `_, Kamoltat) +* mon: prevent new sessions during shutdown (`pr#44543 `_, Sage Weil) +* monitoring/grafana: Grafana query tester (`pr#44316 `_, Ernesto Puerta, Pere Diaz Bou) +* monitoring: mention PyYAML only once in requirements (`pr#44944 `_, Rishabh Dave) +* os/bluestore/AvlAllocator: introduce bluestore_avl_alloc_ff_max\_\* options (`pr#43745 `_, Kefu Chai, Mauricio Faria de Oliveira, Adam Kupczyk) +* os/bluestore: avoid premature onode release (`pr#44723 `_, Igor Fedotov) +* os/bluestore: make shared blob fsck much less RAM-greedy (`pr#44613 `_, Igor Fedotov) +* os/bluestore: use proper prefix when removing undecodable Share Blob (`pr#43882 `_, Igor Fedotov) +* osd/OSD: Log aggregated slow ops detail to cluster logs (`pr#44771 `_, Prashant D) +* osd/OSDMap.cc: clean up pg_temp for nonexistent pgs (`pr#44096 `_, Cory Snyder) +* osd/OSDMap: Add health warning if 'require-osd-release' != current release (`pr#44259 `_, Sridhar Seshasayee, Patrick Donnelly, Neha Ojha) +* osd/OSDMapMapping: fix spurious threadpool timeout errors (`pr#44545 `_, Sage Weil) +* osd/PeeringState: separate history's pruub from pg's (`pr#44584 `_, Sage Weil) +* osd/PrimaryLogPG.cc: CEPH_OSD_OP_OMAPRMKEYRANGE should mark omap dirty (`pr#45591 `_, Neha Ojha) +* osd/scrub: destruct the scrubber shortly before the PG is destructed (`pr#45731 `_, Ronen Friedman) +* osd/scrub: only telling the scrubber of awaited-for 'updates' events (`pr#45365 `_, Ronen Friedman) +* osd/scrub: remove reliance of Scrubber objects' logging on the PG (`pr#45729 `_, Ronen Friedman) +* osd/scrub: restart snap trimming only after scrubbing is done (`pr#45785 `_, Ronen Friedman) +* osd/scrub: stop sending bogus digest-update events (`issue#54423 `_, `pr#45194 `_, Ronen Friedman) +* osd/scrub: tag replica scrub messages to identify stale events (`pr#45374 `_, Ronen Friedman) +* osd: add pg_num_max value & pg_num_max reordering (`pr#45173 `_, Kamoltat, Sage Weil) +* osd: fix 'ceph osd stop ' doesn't take effect (`pr#43955 `_, tan changzhi) +* osd: fix the truncation of an int by int division (`pr#45376 `_, Ronen Friedman) +* osd: PeeringState: fix selection order in calc_replicated_acting_stretch (`pr#44664 `_, Greg Farnum) +* osd: recover unreadable snapshot before reading ref. count info (`pr#44181 `_, Myoungwon Oh) +* osd: require osd_pg_max_concurrent_snap_trims > 0 (`pr#45323 `_, Dan van der Ster) +* osd: set r only if succeed in FillInVerifyExtent (`pr#44173 `_, yanqiang-ux) +* osdc: add set_error in BufferHead, when split set_error to right (`pr#44725 `_, jiawd) +* pacfic: doc/rados/operations/placement-groups: fix --bulk docs (`pr#45328 `_, Kamoltat) +* Pacific fast shutdown backports (`pr#45654 `_, Sridhar Seshasayee, Nitzan Mordechai, Satoru Takeuchi) +* pybind/mgr/balancer: define Plan.{dump,show}() (`pr#43964 `_, Kefu Chai) +* pybind/mgr/progress: enforced try and except on accessing event dictionary (`pr#44672 `_, Kamoltat) +* python-common: add int value validation for count and count_per_host (`pr#44527 `_, John Mulligan) +* python-common: improve OSD spec error messages (`pr#44626 `_, Sebastian Wagner) +* qa/distros/podman: remove centos_8.2 and centos_8.3 (`pr#44903 `_, Neha Ojha) +* qa/rgw: add failing tempest test to blocklist (`pr#45436 `_, Casey Bodley) +* qa/rgw: barbican and pykmip tasks upgrade pip before installing pytz (`pr#45444 `_, Casey Bodley) +* qa/rgw: bump tempest version to resolve dependency issue (`pr#43966 `_, Casey Bodley) +* qa/rgw: Fix vault token file access (`issue#51539 `_, `pr#43951 `_, Marcus Watts) +* qa/rgw: update apache-maven mirror for rgw/hadoop-s3a (`pr#45445 `_, Casey Bodley) +* qa/rgw: use symlinks for rgw/sts suite, target supported-random-distro$ (`pr#45245 `_, Casey Bodley) +* qa/run-tox-mgr-dashboard: Do not write to /tmp/test_sanitize_password… (`pr#44727 `_, Kevin Zhao) +* qa/run_xfstests_qemu.sh: stop reporting success without actually running any tests (`pr#44596 `_, Ilya Dryomov) +* qa/suites/fs: add prefetch_dirfrags false to thrasher suite (`pr#44504 `_, Arthur Outhenin-Chalandre) +* qa/suites/orch/cephadm: Also run the rbd/iscsi suite (`pr#44635 `_, Sebastian Wagner) +* qa/tasks/qemu: make sure block-rbd.so is installed (`pr#45072 `_, Ilya Dryomov) +* qa/tasks: improve backfill_toofull test (`pr#44387 `_, Mykola Golub) +* qa/tests: added upgrade-clients/client-upgrade-pacific-quincy test (`pr#45326 `_, Yuri Weinstein) +* qa/tests: replaced 16.2.6 with 16.2.7 version (`pr#44369 `_, Yuri Weinstein) +* qa: adjust for MDSs to get deployed before verifying their availability (`issue#53857 `_, `pr#44639 `_, Venky Shankar) +* qa: Default to CentOS 8 Stream (`pr#44889 `_, David Galloway) +* qa: do not use any time related suffix for \*_op_timeouts (`pr#44621 `_, Xiubo Li) +* qa: fsync dir for asynchronous creat on stray tests (`pr#45565 `_, Patrick Donnelly, Ramana Raja) +* qa: ignore expected metadata cluster log error (`pr#45564 `_, Patrick Donnelly) +* qa: increase the timeout value to wait a litte longer (`pr#43979 `_, Xiubo Li) +* qa: move certificates for kmip task into /etc/ceph (`pr#45413 `_, Ali Maredia) +* qa: remove centos8 from supported distros (`pr#44865 `_, Casey Bodley, Sage Weil) +* qa: skip sanity check during upgrade (`pr#44840 `_, Milind Changire) +* qa: split distro for rados/cephadm/smoke tests (`pr#44681 `_, Guillaume Abrioux) +* qa: wait for purge queue operations to finish (`issue#52487 `_, `pr#44642 `_, Venky Shankar) +* radosgw-admin: 'sync status' is not behind if there are no mdlog entries (`pr#45442 `_, Casey Bodley) +* rbd persistent cache UX improvements (status report, metrics, flush command) (`pr#45895 `_, Ilya Dryomov, Yin Congmin) +* rbd-mirror: fix races in snapshot-based mirroring deletion propagation (`pr#44754 `_, Ilya Dryomov) +* rbd-mirror: make mirror properly detect pool replayer needs restart (`pr#45170 `_, Mykola Golub) +* rbd-mirror: make RemoveImmediateUpdate test synchronous (`pr#44094 `_, Arthur Outhenin-Chalandre) +* rbd-mirror: synchronize with in-flight stop in ImageReplayer::stop() (`pr#45184 `_, Ilya Dryomov) +* rbd: add missing switch arguments for recognition by get_command_spec() (`pr#44742 `_, Ilya Dryomov) +* rbd: mark optional positional arguments as such in help output (`pr#45008 `_, Ilya Dryomov) +* rbd: recognize rxbounce map option (`pr#45002 `_, Ilya Dryomov) +* Revert "mds: kill session when mds do ms_handle_remote_reset" (`pr#45557 `_, Venky Shankar) +* revert bootstrap network handling changes (`pr#46085 `_, Adam King) +* revival and backport of fix for RocksDB optimized iterators (`pr#46096 `_, Adam Kupczyk, Cory Snyder) +* RGW - Zipper - Make default args match in get_obj_state (`pr#45438 `_, Daniel Gryniewicz) +* RGW - Zipper - Make sure PostObj has bucket set (`pr#45060 `_, Daniel Gryniewicz) +* rgw/admin: fix radosgw-admin datalog list max-entries issue (`pr#45500 `_, Yuval Lifshitz) +* rgw/amqp: add default case to silence compiler warning (`pr#45478 `_, Casey Bodley) +* rgw/amqp: remove the explicit "disconnect()" interface (`pr#45427 `_, Yuval Lifshitz) +* rgw/beast: optimizations for request timeout (`pr#43946 `_, Mark Kogan, Casey Bodley) +* rgw/notification: send correct size in COPY events (`pr#45426 `_, Yuval Lifshitz) +* rgw/sts: adding role name and role session to ops log (`pr#43956 `_, Pritha Srivastava) +* rgw: add object null point judging when listing pubsub topics (`pr#45476 `_, zhipeng li) +* rgw: add OPT_BUCKET_SYNC_RUN to gc_ops_list, so that (`pr#45421 `_, Pritha Srivastava) +* rgw: add the condition of lock mode conversion to PutObjRentention (`pr#45440 `_, wangzhong) +* rgw: bucket chown bad memory usage (`pr#45491 `_, Mohammad Fatemipour) +* rgw: change order of xml elements in ListRoles response (`pr#45448 `_, Casey Bodley) +* rgw: clean-up logging of function entering to make thorough and consistent (`pr#45450 `_, J. Eric Ivancich) +* rgw: cls_bucket_list_unordered() might return one redundent entry every time is_truncated is true (`pr#45457 `_, Peng Zhang) +* rgw: default ms_mon_client_mode = secure (`pr#45439 `_, Sage Weil) +* rgw: document rgw_lc_debug_interval configuration option (`pr#45453 `_, J. Eric Ivancich) +* rgw: document S3 bucket replication support (`pr#45484 `_, Matt Benjamin) +* rgw: Dump Object Lock Retain Date as ISO 8601 (`pr#44697 `_, Danny Abukalam) +* rgw: fix `bi put` not using right bucket index shard (`pr#44166 `_, J. Eric Ivancich) +* rgw: fix lock scope in ObjectCache::get() (`pr#44747 `_, Casey Bodley) +* rgw: fix md5 not match for RGWBulkUploadOp upload when enable rgw com… (`pr#45432 `_, yuliyang_yewu) +* rgw: fix rgw.none statistics (`pr#45463 `_, J. Eric Ivancich) +* rgw: fix segfault in UserAsyncRefreshHandler::init_fetch (`pr#45411 `_, Cory Snyder) +* rgw: forward request in multisite for RGWDeleteBucketPolicy and RGWDeleteBucketPublicAccessBlock (`pr#45434 `_, yuliyang_yewu) +* rgw: have "bucket check --fix" fix pool ids correctly (`pr#45455 `_, J. Eric Ivancich) +* rgw: in bucket reshard list, clarify new num shards is tentative (`pr#45509 `_, J. Eric Ivancich) +* rgw: init bucket index only if putting bucket instance info succeeds (`pr#45480 `_, Huber-ming) +* rgw: RadosBucket::get_bucket_info() updates RGWBucketEnt (`pr#45483 `_, Casey Bodley) +* rgw: remove bucket API returns NoSuchKey than NoSuchBucket (`pr#45489 `_, Satoru Takeuchi) +* rgw: resolve empty ordered bucket listing results w/ CLS filtering \*and\* bucket index list produces incorrect result when non-ascii entries (`pr#45087 `_, J. Eric Ivancich) +* rgw: RGWPostObj::execute() may lost data (`pr#45502 `_, Lei Zhang) +* rgw: under fips, set flag to allow md5 in select rgw ops (`pr#44778 `_, Mark Kogan) +* rgw: url_decode before parsing copysource in copyobject (`issue#43259 `_, `pr#45430 `_, Paul Reece) +* rgw: user stats showing 0 value for "size_utilized" and "size_kb_utilized" fields (`pr#44171 `_, J. Eric Ivancich) +* rgw: write meta of a MP part to a correct pool (`issue#49128 `_, `pr#45428 `_, Jeegn Chen) +* rgw:When KMS encryption is used and the key does not exist, we should… (`pr#45461 `_, wangyingbin) +* rgwlc: remove lc entry on bucket delete (`pr#44729 `_, Matt Benjamin) +* rgwlc: warn on missing RGW_ATTR_LC (`pr#45497 `_, Matt Benjamin) +* src/ceph-crash.in: various enhancements and fixes (`pr#45381 `_, Sébastien Han) +* src/rgw: Fix for malformed url (`pr#45459 `_, Kalpesh Pandya) +* test/librbd/test_notify.py: effect post object map rebuild assert (`pr#45311 `_, Ilya Dryomov) +* test/librbd: add test to verify diff_iterate size (`pr#45555 `_, Christopher Hoffman) +* test/librbd: harden RemoveFullTry tests (`pr#43649 `_, Ilya Dryomov) +* test/rgw: disable cls_rgw_gc test cases with defer_gc() (`pr#45477 `_, Casey Bodley) +* test: fix wrong alarm (HitSetWrite) (`pr#45319 `_, Myoungwon Oh) +* test: increase retry duration when calculating manifest ref. count (`pr#44202 `_, Myoungwon Oh) +* tools/rbd: expand where option rbd_default_map_options can be set (`pr#45181 `_, Christopher Hoffman, Ilya Dryomov) +* Wip doc pr 46109 backport to pacific (`pr#46117 `_, Ville Ojamo) + + v16.2.7 Pacific =============== diff --git a/doc/security/CVE-2022-0670.rst b/doc/security/CVE-2022-0670.rst new file mode 100644 index 0000000000000..54ebb7f907cb4 --- /dev/null +++ b/doc/security/CVE-2022-0670.rst @@ -0,0 +1,43 @@ +.. _CVE-2022-0670: + +CVE-2022-0670: Native-CephFS Manila Path-restriction bypass +=========================================================== + +Summary +------- + +Users who were running OpenStack Manila to export native CephFS, who +upgraded their Ceph cluster from Nautilus (or earlier) to a later +major version, were vulnerable to an attack by malicious users. The +vulnerability allowed users to obtain access to arbitrary portions of +the CephFS filesystem hierarchy, instead of being properly restricted +to their own subvolumes. The vulnerability is due to a bug in the +"volumes" plugin in Ceph Manager. This plugin is responsible for +managing Ceph File System subvolumes which are used by OpenStack +Manila services as a way to provide shares to Manila users. + +Again, this vulnerability only impacts OpenStack Manila clusters which +provided native CephFS access to their users. + +Affected versions +----------------- + +Any version of Ceph running OpenStack Manila that was upgraded from Nautilus +or earlier. + +Fixed versions +-------------- + +* Quincy v17.2.2 (and later) +* Pacific v16.2.10 (and later) +* Octopus v15.2.17 + +Recommendations +--------------- + +#. Users should upgrade to a patched version of Ceph at their earliest + convenience. + +#. Administrators who are + concerned they may have been impacted should audit the CephX keys in + their cluster for proper path restrictions. diff --git a/doc/security/cves.rst b/doc/security/cves.rst index 223b61634fd49..8bbccbf64d6ea 100644 --- a/doc/security/cves.rst +++ b/doc/security/cves.rst @@ -2,81 +2,85 @@ Past vulnerabilities ==================== -+------------+-------------------+-------------+--------------------------------------------+ -| Published | CVE | Severity | Summary | -+------------+-------------------+-------------+--------------------------------------------+ -| 2021-05-13 | `CVE-2021-3531`_ | Medium | Swift API denial of service | -+------------+-------------------+-------------+--------------------------------------------+ -| 2021-05-13 | `CVE-2021-3524`_ | Medium | HTTP header injects via CORS in RGW | -+------------+-------------------+-------------+--------------------------------------------+ -| 2021-05-13 | `CVE-2021-3509`_ | High | Dashboard XSS via token cookie | -+------------+-------------------+-------------+--------------------------------------------+ -| 2021-04-14 | `CVE-2021-20288`_ | High | Unauthorized global_id reuse in cephx | -+------------+-------------------+-------------+--------------------------------------------+ -| 2020-12-18 | `CVE-2020-27781`_ | 7.1 High | CephFS creds read/modified by Manila users | -+------------+-------------------+-------------+--------------------------------------------+ -| 2021-01-08 | `CVE-2020-25678`_ | 4.9 Medium | mgr module passwords in clear text | -+------------+-------------------+-------------+--------------------------------------------+ -| 2020-12-07 | `CVE-2020-25677`_ | 5.5 Medium | ceph-ansible iscsi-gateway.conf perm | -+------------+-------------------+-------------+--------------------------------------------+ -| 2020-11-23 | `CVE-2020-25660`_ | 8.8 High | Cephx replay vulnerability | -+------------+-------------------+-------------+--------------------------------------------+ -| 2020-04-22 | `CVE-2020-12059`_ | 7.5 High | malformed POST could crash RGW | -+------------+-------------------+-------------+--------------------------------------------+ -| 2020-06-26 | `CVE-2020-10753`_ | 6.5 Medium | HTTP header injects via CORS in RGW | -+------------+-------------------+-------------+--------------------------------------------+ -| 2020-06-22 | `CVE-2020-10736`_ | 8.0 High | authorization bypass in mon and mgr | -+------------+-------------------+-------------+--------------------------------------------+ -| 2020-04-23 | `CVE-2020-1760`_ | 6.1 Medium | potential RGW XSS attack | -+------------+-------------------+-------------+--------------------------------------------+ -| 2020-04-13 | `CVE-2020-1759`_ | 6.8 Medium | Cephx nonce reuse in secure mode | -+------------+-------------------+-------------+--------------------------------------------+ -| 2020-02-07 | `CVE-2020-1700`_ | 6.5 Medium | RGW disconnects leak sockets, can DoS | -+------------+-------------------+-------------+--------------------------------------------+ -| 2020-04-21 | `CVE-2020-1699`_ | 7.5 High | Dashboard path traversal flaw | -+------------+-------------------+-------------+--------------------------------------------+ -| 2019-12-23 | `CVE-2019-19337`_ | 6.5 Medium | RGW DoS via malformed headers | -+------------+-------------------+-------------+--------------------------------------------+ -| 2019-11-08 | `CVE-2019-10222`_ | 7.5 High | Invalid HTTP headers could crash RGW | -+------------+-------------------+-------------+--------------------------------------------+ -| 2019-03-27 | `CVE-2019-3821`_ | 7.5 High | RGW file descriptors could be exhausted | -+------------+-------------------+-------------+--------------------------------------------+ -| 2019-01-28 | `CVE-2018-16889`_ | 7.5 High | encryption keys logged in plaintext | -+------------+-------------------+-------------+--------------------------------------------+ -| 2019-01-15 | `CVE-2018-16846`_ | 6.5 Medium | authenticated RGW users can cause DoS | -+------------+-------------------+-------------+--------------------------------------------+ -| 2019-01-15 | `CVE-2018-14662`_ | 5.7 Medium | read-only users could steal dm-crypt keys | -+------------+-------------------+-------------+--------------------------------------------+ -| 2018-07-10 | `CVE-2018-10861`_ | 8.1 High | authenticated user can create/delete pools | -+------------+-------------------+-------------+--------------------------------------------+ -| 2018-03-19 | `CVE-2018-7262`_ | 7.5 High | malformed headers can cause RGW DoS | -+------------+-------------------+-------------+--------------------------------------------+ -| 2018-07-10 | `CVE-2018-1129`_ | 6.5 Medium | network MITM can tamper with messages | -+------------+-------------------+-------------+--------------------------------------------+ -| 2018-07-10 | `CVE-2018-1128`_ | 7.5 High | Cephx replay vulnerability | -+------------+-------------------+-------------+--------------------------------------------+ -| 2018-07-27 | `CVE-2017-7519`_ | 4.4 Medium | libradosstriper unvalidated format string | -+------------+-------------------+-------------+--------------------------------------------+ -| 2018-08-01 | `CVE-2016-9579`_ | 7.6 High | potential RGW XSS attack | -+------------+-------------------+-------------+--------------------------------------------+ -| 2018-07-31 | `CVE-2016-8626`_ | 6.5 Medium | malformed POST can DoS RGW | -+------------+-------------------+-------------+--------------------------------------------+ -| 2016-10-03 | `CVE-2016-7031`_ | 7.5 High | RGW unauthorized bucket listing | -+------------+-------------------+-------------+--------------------------------------------+ -| 2016-07-12 | `CVE-2016-5009`_ | 6.5 Medium | mon command handler DoS | -+------------+-------------------+-------------+--------------------------------------------+ -| 2016-12-03 | `CVE-2015-5245`_ | | RGW header injection | -+------------+-------------------+-------------+--------------------------------------------+ ++------------+-------------------+-------------+---------------------------------------------+ +| Published | CVE | Severity | Summary | ++------------+-------------------+-------------+---------------------------------------------+ +| 2022-07-21 | `CVE-2022-0670`_ | Medium | Native-CephFS Manila Path-restriction bypass| ++------------+-------------------+-------------+---------------------------------------------+ +| 2021-05-13 | `CVE-2021-3531`_ | Medium | Swift API denial of service | ++------------+-------------------+-------------+---------------------------------------------+ +| 2021-05-13 | `CVE-2021-3524`_ | Medium | HTTP header injects via CORS in RGW | ++------------+-------------------+-------------+---------------------------------------------+ +| 2021-05-13 | `CVE-2021-3509`_ | High | Dashboard XSS via token cookie | ++------------+-------------------+-------------+---------------------------------------------+ +| 2021-04-14 | `CVE-2021-20288`_ | High | Unauthorized global_id reuse in cephx | ++------------+-------------------+-------------+---------------------------------------------+ +| 2020-12-18 | `CVE-2020-27781`_ | 7.1 High | CephFS creds read/modified by Manila users | ++------------+-------------------+-------------+---------------------------------------------+ +| 2021-01-08 | `CVE-2020-25678`_ | 4.9 Medium | mgr module passwords in clear text | ++------------+-------------------+-------------+---------------------------------------------+ +| 2020-12-07 | `CVE-2020-25677`_ | 5.5 Medium | ceph-ansible iscsi-gateway.conf perm | ++------------+-------------------+-------------+---------------------------------------------+ +| 2020-11-23 | `CVE-2020-25660`_ | 8.8 High | Cephx replay vulnerability | ++------------+-------------------+-------------+---------------------------------------------+ +| 2020-04-22 | `CVE-2020-12059`_ | 7.5 High | malformed POST could crash RGW | ++------------+-------------------+-------------+---------------------------------------------+ +| 2020-06-26 | `CVE-2020-10753`_ | 6.5 Medium | HTTP header injects via CORS in RGW | ++------------+-------------------+-------------+---------------------------------------------+ +| 2020-06-22 | `CVE-2020-10736`_ | 8.0 High | authorization bypass in mon and mgr | ++------------+-------------------+-------------+---------------------------------------------+ +| 2020-04-23 | `CVE-2020-1760`_ | 6.1 Medium | potential RGW XSS attack | ++------------+-------------------+-------------+---------------------------------------------+ +| 2020-04-13 | `CVE-2020-1759`_ | 6.8 Medium | Cephx nonce reuse in secure mode | ++------------+-------------------+-------------+---------------------------------------------+ +| 2020-02-07 | `CVE-2020-1700`_ | 6.5 Medium | RGW disconnects leak sockets, can DoS | ++------------+-------------------+-------------+---------------------------------------------+ +| 2020-04-21 | `CVE-2020-1699`_ | 7.5 High | Dashboard path traversal flaw | ++------------+-------------------+-------------+---------------------------------------------+ +| 2019-12-23 | `CVE-2019-19337`_ | 6.5 Medium | RGW DoS via malformed headers | ++------------+-------------------+-------------+---------------------------------------------+ +| 2019-11-08 | `CVE-2019-10222`_ | 7.5 High | Invalid HTTP headers could crash RGW | ++------------+-------------------+-------------+---------------------------------------------+ +| 2019-03-27 | `CVE-2019-3821`_ | 7.5 High | RGW file descriptors could be exhausted | ++------------+-------------------+-------------+---------------------------------------------+ +| 2019-01-28 | `CVE-2018-16889`_ | 7.5 High | encryption keys logged in plaintext | ++------------+-------------------+-------------+---------------------------------------------+ +| 2019-01-15 | `CVE-2018-16846`_ | 6.5 Medium | authenticated RGW users can cause DoS | ++------------+-------------------+-------------+---------------------------------------------+ +| 2019-01-15 | `CVE-2018-14662`_ | 5.7 Medium | read-only users could steal dm-crypt keys | ++------------+-------------------+-------------+---------------------------------------------+ +| 2018-07-10 | `CVE-2018-10861`_ | 8.1 High | authenticated user can create/delete pools | ++------------+-------------------+-------------+---------------------------------------------+ +| 2018-03-19 | `CVE-2018-7262`_ | 7.5 High | malformed headers can cause RGW DoS | ++------------+-------------------+-------------+---------------------------------------------+ +| 2018-07-10 | `CVE-2018-1129`_ | 6.5 Medium | network MITM can tamper with messages | ++------------+-------------------+-------------+---------------------------------------------+ +| 2018-07-10 | `CVE-2018-1128`_ | 7.5 High | Cephx replay vulnerability | ++------------+-------------------+-------------+---------------------------------------------+ +| 2018-07-27 | `CVE-2017-7519`_ | 4.4 Medium | libradosstriper unvalidated format string | ++------------+-------------------+-------------+---------------------------------------------+ +| 2018-08-01 | `CVE-2016-9579`_ | 7.6 High | potential RGW XSS attack | ++------------+-------------------+-------------+---------------------------------------------+ +| 2018-07-31 | `CVE-2016-8626`_ | 6.5 Medium | malformed POST can DoS RGW | ++------------+-------------------+-------------+---------------------------------------------+ +| 2016-10-03 | `CVE-2016-7031`_ | 7.5 High | RGW unauthorized bucket listing | ++------------+-------------------+-------------+---------------------------------------------+ +| 2016-07-12 | `CVE-2016-5009`_ | 6.5 Medium | mon command handler DoS | ++------------+-------------------+-------------+---------------------------------------------+ +| 2016-12-03 | `CVE-2015-5245`_ | | RGW header injection | ++------------+-------------------+-------------+---------------------------------------------+ .. toctree:: :hidden: :maxdepth: 0 + CVE-2022-0670 CVE-2021-3531 CVE-2021-3524 CVE-2021-3509 CVE-2021-20288 +.. _CVE-2022-0670: ../CVE-2022-0670 .. _CVE-2021-3531: ../CVE-2021-3531 .. _CVE-2021-3524: ../CVE-2021-3524 .. _CVE-2021-3509: ../CVE-2021-3509 -- 2.47.3