Security update for ceph SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2017:2922-1 Final 1 1 2017-11-02T12:09:07Z current 2017-11-02T12:09:07Z 2017-11-02T12:09:07Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for ceph CEPH was updated to version 10.2.10, which brings several fixes and enhancements. Upstream 10.2.10 release summary can be found at: https://ceph.com/releases/v10-2-10-jewel-released/ Security issues fixed: - CVE-2017-7519: libradosstriper processed arbitrary printf placeholders in user input (bsc#1043767) Non-security issues fixed: - Add explicit Before=ceph.target to systemd service file. (bsc#1042973) - ceph-disk omits '--runtime' when enabling ceph-osd@$ID.service units. (bsc#1051598, bsc#1056536) - Make it possible to customize ceph-disk's timeout and set default to 3h. (bsc#1051432) - Move ceph-disk from ceph-common to ceph-base. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-Storage-4-2017-1805 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2017/suse-su-20172922-1/ Link for SUSE-SU-2017:2922-1 https://lists.opensuse.org/opensuse-security-announce/2017-11/msg00002.html E-Mail link for SUSE-SU-2017:2922-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1042973 SUSE Bug 1042973 https://bugzilla.suse.com/1043767 SUSE Bug 1043767 https://bugzilla.suse.com/1051432 SUSE Bug 1051432 https://bugzilla.suse.com/1051598 SUSE Bug 1051598 https://bugzilla.suse.com/1056536 SUSE Bug 1056536 https://www.suse.com/security/cve/CVE-2017-7519/ SUSE CVE CVE-2017-7519 page SUSE Enterprise Storage 4 ceph-10.2.10+git.1507616349.698469bd8d-12.6.1 ceph-base-10.2.10+git.1507616349.698469bd8d-12.6.1 ceph-common-10.2.10+git.1507616349.698469bd8d-12.6.1 ceph-fuse-10.2.10+git.1507616349.698469bd8d-12.6.1 ceph-mds-10.2.10+git.1507616349.698469bd8d-12.6.1 ceph-mon-10.2.10+git.1507616349.698469bd8d-12.6.1 ceph-osd-10.2.10+git.1507616349.698469bd8d-12.6.1 ceph-radosgw-10.2.10+git.1507616349.698469bd8d-12.6.1 ceph-test-10.2.10+git.1507616349.698469bd8d-12.6.1 libcephfs1-10.2.10+git.1507616349.698469bd8d-12.6.1 librados2-10.2.10+git.1507616349.698469bd8d-12.6.1 libradosstriper1-10.2.10+git.1507616349.698469bd8d-12.6.1 librbd1-10.2.10+git.1507616349.698469bd8d-12.6.1 librgw2-10.2.10+git.1507616349.698469bd8d-12.6.1 python-ceph-compat-10.2.10+git.1507616349.698469bd8d-12.6.1 python-cephfs-10.2.10+git.1507616349.698469bd8d-12.6.1 python-rados-10.2.10+git.1507616349.698469bd8d-12.6.1 python-rbd-10.2.10+git.1507616349.698469bd8d-12.6.1 rbd-fuse-10.2.10+git.1507616349.698469bd8d-12.6.1 rbd-mirror-10.2.10+git.1507616349.698469bd8d-12.6.1 rbd-nbd-10.2.10+git.1507616349.698469bd8d-12.6.1 ceph-10.2.10+git.1507616349.698469bd8d-12.6.1 as a component of SUSE Enterprise Storage 4 ceph-base-10.2.10+git.1507616349.698469bd8d-12.6.1 as a component of SUSE Enterprise Storage 4 ceph-common-10.2.10+git.1507616349.698469bd8d-12.6.1 as a component of SUSE Enterprise Storage 4 ceph-fuse-10.2.10+git.1507616349.698469bd8d-12.6.1 as a component of SUSE Enterprise Storage 4 ceph-mds-10.2.10+git.1507616349.698469bd8d-12.6.1 as a component of SUSE Enterprise Storage 4 ceph-mon-10.2.10+git.1507616349.698469bd8d-12.6.1 as a component of SUSE Enterprise Storage 4 ceph-osd-10.2.10+git.1507616349.698469bd8d-12.6.1 as a component of SUSE Enterprise Storage 4 ceph-radosgw-10.2.10+git.1507616349.698469bd8d-12.6.1 as a component of SUSE Enterprise Storage 4 ceph-test-10.2.10+git.1507616349.698469bd8d-12.6.1 as a component of SUSE Enterprise Storage 4 libcephfs1-10.2.10+git.1507616349.698469bd8d-12.6.1 as a component of SUSE Enterprise Storage 4 librados2-10.2.10+git.1507616349.698469bd8d-12.6.1 as a component of SUSE Enterprise Storage 4 libradosstriper1-10.2.10+git.1507616349.698469bd8d-12.6.1 as a component of SUSE Enterprise Storage 4 librbd1-10.2.10+git.1507616349.698469bd8d-12.6.1 as a component of SUSE Enterprise Storage 4 librgw2-10.2.10+git.1507616349.698469bd8d-12.6.1 as a component of SUSE Enterprise Storage 4 python-ceph-compat-10.2.10+git.1507616349.698469bd8d-12.6.1 as a component of SUSE Enterprise Storage 4 python-cephfs-10.2.10+git.1507616349.698469bd8d-12.6.1 as a component of SUSE Enterprise Storage 4 python-rados-10.2.10+git.1507616349.698469bd8d-12.6.1 as a component of SUSE Enterprise Storage 4 python-rbd-10.2.10+git.1507616349.698469bd8d-12.6.1 as a component of SUSE Enterprise Storage 4 rbd-fuse-10.2.10+git.1507616349.698469bd8d-12.6.1 as a component of SUSE Enterprise Storage 4 rbd-mirror-10.2.10+git.1507616349.698469bd8d-12.6.1 as a component of SUSE Enterprise Storage 4 rbd-nbd-10.2.10+git.1507616349.698469bd8d-12.6.1 as a component of SUSE Enterprise Storage 4 In Ceph, a format string flaw was found in the way libradosstriper parses input from user. A user could crash an application or service using the libradosstriper library. CVE-2017-7519 SUSE Enterprise Storage 4:ceph-10.2.10+git.1507616349.698469bd8d-12.6.1 SUSE Enterprise Storage 4:ceph-base-10.2.10+git.1507616349.698469bd8d-12.6.1 SUSE Enterprise Storage 4:ceph-common-10.2.10+git.1507616349.698469bd8d-12.6.1 SUSE Enterprise Storage 4:ceph-fuse-10.2.10+git.1507616349.698469bd8d-12.6.1 SUSE Enterprise Storage 4:ceph-mds-10.2.10+git.1507616349.698469bd8d-12.6.1 SUSE Enterprise Storage 4:ceph-mon-10.2.10+git.1507616349.698469bd8d-12.6.1 SUSE Enterprise Storage 4:ceph-osd-10.2.10+git.1507616349.698469bd8d-12.6.1 SUSE Enterprise Storage 4:ceph-radosgw-10.2.10+git.1507616349.698469bd8d-12.6.1 SUSE Enterprise Storage 4:ceph-test-10.2.10+git.1507616349.698469bd8d-12.6.1 SUSE Enterprise Storage 4:libcephfs1-10.2.10+git.1507616349.698469bd8d-12.6.1 SUSE Enterprise Storage 4:librados2-10.2.10+git.1507616349.698469bd8d-12.6.1 SUSE Enterprise Storage 4:libradosstriper1-10.2.10+git.1507616349.698469bd8d-12.6.1 SUSE Enterprise Storage 4:librbd1-10.2.10+git.1507616349.698469bd8d-12.6.1 SUSE Enterprise Storage 4:librgw2-10.2.10+git.1507616349.698469bd8d-12.6.1 SUSE Enterprise Storage 4:python-ceph-compat-10.2.10+git.1507616349.698469bd8d-12.6.1 SUSE Enterprise Storage 4:python-cephfs-10.2.10+git.1507616349.698469bd8d-12.6.1 SUSE Enterprise Storage 4:python-rados-10.2.10+git.1507616349.698469bd8d-12.6.1 SUSE Enterprise Storage 4:python-rbd-10.2.10+git.1507616349.698469bd8d-12.6.1 SUSE Enterprise Storage 4:rbd-fuse-10.2.10+git.1507616349.698469bd8d-12.6.1 SUSE Enterprise Storage 4:rbd-mirror-10.2.10+git.1507616349.698469bd8d-12.6.1 SUSE Enterprise Storage 4:rbd-nbd-10.2.10+git.1507616349.698469bd8d-12.6.1 important 3.5 AV:N/AC:M/Au:S/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172922-1/ https://www.suse.com/security/cve/CVE-2017-7519.html CVE-2017-7519 https://bugzilla.suse.com/1043767 SUSE Bug 1043767