-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: ceph security update Advisory ID: RHSA-2019:2577-01 Product: Red Hat Ceph Storage Advisory URL: https://access.redhat.com/errata/RHSA-2019:2577 Issue date: 2019-08-28 CVE Names: CVE-2019-10222 ==================================================================== 1. Summary: An update is now available for Red Hat Ceph Storage 3.3 on Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Ceph Storage 3.3 MON - ppc64le, x86_64 Red Hat Ceph Storage 3.3 OSD - ppc64le, x86_64 Red Hat Ceph Storage 3.3 Tools - ppc64le, x86_64 3. Description: Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable version of the Ceph storage system with a Ceph management platform, deployment utilities, and support services. Security Fix(es): * ceph: Unauthenticated clients can crash ceph RGW configured with beast as frontend (CVE-2019-10222) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1739292 - CVE-2019-10222 ceph: Unauthenticated clients can crash ceph RGW configured with beast as frontend 6. Package List: Red Hat Ceph Storage 3.3 MON: Source: ceph-12.2.12-48.el7cp.src.rpm ppc64le: ceph-base-12.2.12-48.el7cp.ppc64le.rpm ceph-common-12.2.12-48.el7cp.ppc64le.rpm ceph-debuginfo-12.2.12-48.el7cp.ppc64le.rpm ceph-mgr-12.2.12-48.el7cp.ppc64le.rpm ceph-mon-12.2.12-48.el7cp.ppc64le.rpm ceph-selinux-12.2.12-48.el7cp.ppc64le.rpm libcephfs-devel-12.2.12-48.el7cp.ppc64le.rpm libcephfs2-12.2.12-48.el7cp.ppc64le.rpm librados-devel-12.2.12-48.el7cp.ppc64le.rpm librados2-12.2.12-48.el7cp.ppc64le.rpm libradosstriper1-12.2.12-48.el7cp.ppc64le.rpm librbd-devel-12.2.12-48.el7cp.ppc64le.rpm librbd1-12.2.12-48.el7cp.ppc64le.rpm librgw-devel-12.2.12-48.el7cp.ppc64le.rpm librgw2-12.2.12-48.el7cp.ppc64le.rpm python-cephfs-12.2.12-48.el7cp.ppc64le.rpm python-rados-12.2.12-48.el7cp.ppc64le.rpm python-rbd-12.2.12-48.el7cp.ppc64le.rpm python-rgw-12.2.12-48.el7cp.ppc64le.rpm x86_64: ceph-base-12.2.12-48.el7cp.x86_64.rpm ceph-common-12.2.12-48.el7cp.x86_64.rpm ceph-debuginfo-12.2.12-48.el7cp.x86_64.rpm ceph-mgr-12.2.12-48.el7cp.x86_64.rpm ceph-mon-12.2.12-48.el7cp.x86_64.rpm ceph-selinux-12.2.12-48.el7cp.x86_64.rpm ceph-test-12.2.12-48.el7cp.x86_64.rpm libcephfs-devel-12.2.12-48.el7cp.x86_64.rpm libcephfs2-12.2.12-48.el7cp.x86_64.rpm librados-devel-12.2.12-48.el7cp.x86_64.rpm librados2-12.2.12-48.el7cp.x86_64.rpm libradosstriper1-12.2.12-48.el7cp.x86_64.rpm librbd-devel-12.2.12-48.el7cp.x86_64.rpm librbd1-12.2.12-48.el7cp.x86_64.rpm librgw-devel-12.2.12-48.el7cp.x86_64.rpm librgw2-12.2.12-48.el7cp.x86_64.rpm python-cephfs-12.2.12-48.el7cp.x86_64.rpm python-rados-12.2.12-48.el7cp.x86_64.rpm python-rbd-12.2.12-48.el7cp.x86_64.rpm python-rgw-12.2.12-48.el7cp.x86_64.rpm Red Hat Ceph Storage 3.3 OSD: Source: ceph-12.2.12-48.el7cp.src.rpm ppc64le: ceph-base-12.2.12-48.el7cp.ppc64le.rpm ceph-common-12.2.12-48.el7cp.ppc64le.rpm ceph-debuginfo-12.2.12-48.el7cp.ppc64le.rpm ceph-osd-12.2.12-48.el7cp.ppc64le.rpm ceph-selinux-12.2.12-48.el7cp.ppc64le.rpm libcephfs-devel-12.2.12-48.el7cp.ppc64le.rpm libcephfs2-12.2.12-48.el7cp.ppc64le.rpm librados-devel-12.2.12-48.el7cp.ppc64le.rpm librados2-12.2.12-48.el7cp.ppc64le.rpm libradosstriper1-12.2.12-48.el7cp.ppc64le.rpm librbd-devel-12.2.12-48.el7cp.ppc64le.rpm librbd1-12.2.12-48.el7cp.ppc64le.rpm librgw-devel-12.2.12-48.el7cp.ppc64le.rpm librgw2-12.2.12-48.el7cp.ppc64le.rpm python-cephfs-12.2.12-48.el7cp.ppc64le.rpm python-rados-12.2.12-48.el7cp.ppc64le.rpm python-rbd-12.2.12-48.el7cp.ppc64le.rpm python-rgw-12.2.12-48.el7cp.ppc64le.rpm x86_64: ceph-base-12.2.12-48.el7cp.x86_64.rpm ceph-common-12.2.12-48.el7cp.x86_64.rpm ceph-debuginfo-12.2.12-48.el7cp.x86_64.rpm ceph-osd-12.2.12-48.el7cp.x86_64.rpm ceph-selinux-12.2.12-48.el7cp.x86_64.rpm ceph-test-12.2.12-48.el7cp.x86_64.rpm libcephfs-devel-12.2.12-48.el7cp.x86_64.rpm libcephfs2-12.2.12-48.el7cp.x86_64.rpm librados-devel-12.2.12-48.el7cp.x86_64.rpm librados2-12.2.12-48.el7cp.x86_64.rpm libradosstriper1-12.2.12-48.el7cp.x86_64.rpm librbd-devel-12.2.12-48.el7cp.x86_64.rpm librbd1-12.2.12-48.el7cp.x86_64.rpm librgw-devel-12.2.12-48.el7cp.x86_64.rpm librgw2-12.2.12-48.el7cp.x86_64.rpm python-cephfs-12.2.12-48.el7cp.x86_64.rpm python-rados-12.2.12-48.el7cp.x86_64.rpm python-rbd-12.2.12-48.el7cp.x86_64.rpm python-rgw-12.2.12-48.el7cp.x86_64.rpm Red Hat Ceph Storage 3.3 Tools: Source: ceph-12.2.12-48.el7cp.src.rpm ppc64le: ceph-base-12.2.12-48.el7cp.ppc64le.rpm ceph-common-12.2.12-48.el7cp.ppc64le.rpm ceph-debuginfo-12.2.12-48.el7cp.ppc64le.rpm ceph-fuse-12.2.12-48.el7cp.ppc64le.rpm ceph-mds-12.2.12-48.el7cp.ppc64le.rpm ceph-radosgw-12.2.12-48.el7cp.ppc64le.rpm ceph-selinux-12.2.12-48.el7cp.ppc64le.rpm libcephfs-devel-12.2.12-48.el7cp.ppc64le.rpm libcephfs2-12.2.12-48.el7cp.ppc64le.rpm librados-devel-12.2.12-48.el7cp.ppc64le.rpm librados2-12.2.12-48.el7cp.ppc64le.rpm libradosstriper1-12.2.12-48.el7cp.ppc64le.rpm librbd-devel-12.2.12-48.el7cp.ppc64le.rpm librbd1-12.2.12-48.el7cp.ppc64le.rpm librgw-devel-12.2.12-48.el7cp.ppc64le.rpm librgw2-12.2.12-48.el7cp.ppc64le.rpm python-cephfs-12.2.12-48.el7cp.ppc64le.rpm python-rados-12.2.12-48.el7cp.ppc64le.rpm python-rbd-12.2.12-48.el7cp.ppc64le.rpm python-rgw-12.2.12-48.el7cp.ppc64le.rpm rbd-mirror-12.2.12-48.el7cp.ppc64le.rpm x86_64: ceph-base-12.2.12-48.el7cp.x86_64.rpm ceph-common-12.2.12-48.el7cp.x86_64.rpm ceph-debuginfo-12.2.12-48.el7cp.x86_64.rpm ceph-fuse-12.2.12-48.el7cp.x86_64.rpm ceph-mds-12.2.12-48.el7cp.x86_64.rpm ceph-radosgw-12.2.12-48.el7cp.x86_64.rpm ceph-selinux-12.2.12-48.el7cp.x86_64.rpm libcephfs-devel-12.2.12-48.el7cp.x86_64.rpm libcephfs2-12.2.12-48.el7cp.x86_64.rpm librados-devel-12.2.12-48.el7cp.x86_64.rpm librados2-12.2.12-48.el7cp.x86_64.rpm libradosstriper1-12.2.12-48.el7cp.x86_64.rpm librbd-devel-12.2.12-48.el7cp.x86_64.rpm librbd1-12.2.12-48.el7cp.x86_64.rpm librgw-devel-12.2.12-48.el7cp.x86_64.rpm librgw2-12.2.12-48.el7cp.x86_64.rpm python-cephfs-12.2.12-48.el7cp.x86_64.rpm python-rados-12.2.12-48.el7cp.x86_64.rpm python-rbd-12.2.12-48.el7cp.x86_64.rpm python-rgw-12.2.12-48.el7cp.x86_64.rpm rbd-mirror-12.2.12-48.el7cp.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2019-10222 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2019 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBXWazU9zjgjWX9erEAQiNlRAAm+82xAScGeAB4Oj/DUQYbjTW9tE5joaS U2d/Rh+lrDgHi8d04BhT1thuUomgRxcv6EWi6MgXc5xI/oZK+nxlZy1B9LFbrSdb H4qZKx2TmduGwoCRwrwCpnwveODXFC+gjUyAI88tHQ6i0TlAEsgQAX/qNLQfFU+f eoy6gO08vIhpgNuBL49mcBvr2in5oPeKqn6+QyjKE2qELn7t/4ZrsOPzDmSRiDJQ /xNPpN1rp6YDxZBXgx32Up6KcoMH9w5jFTr1r/+YIQUWztrweLe1WBUglp/O39z/ SMrLvHmVtfdeyDwVoCJd6nywITDdTwXj56KiZw069HNHdKVqrjo/9pwJgYu9KpX3 jFeTsQjLO1nlbayPEy3f4zSDwT3D0308rMYHUI2jLyM0ELKc3eIuqdvh0xpULX5K B/VtHOHRhKCGA/VlRnAzMeFVaZ6B2PhjHUL1hcr0CIVHD6DYgU5I4jXZ/Uzhyk4/ IJs0yRQWmBMIvYOVHhYprfBWUFuAIkmbvQJO72K8onjqkLkXc4RCH+tXHu8q2/Ev C2mEqZcz3rTy4YsIy9Hwu5L/4oYDkPW2dscpY0moMLtrj5w5rv8JJ0zAxBRanqrR 3Ms5zXrgjuxEWANxDt3Utr4Z3e9vEFfGGZUo6+pJq8UEce/cofndNJ9dKJMV91mE K0mCB1BNiBA=io+/ -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce