Description of problem: Version-Release number of selected component (if applicable): How reproducible: Steps to Reproduce: 1. 2. 3. Actual results: Expected results: Additional info:
VxFlexOS backend: Volume-attach failed with KeyError: 'config_group' Seems that os-brick already has security fix and tries to get ‘config_group’ key. However cinder driver does not contain this fix. Don’t know if os-brick package was pulled into RHOSP16.1 that matches the cinder. Its been fixed in this review https://review.opendev.org/#/c/723825 This is related to BZ https://bugzilla.redhat.com/show_bug.cgi?id=1808570.
Created attachment 1702983 [details] Nova logs
Because this version of the driver in OSP-16.1 was backported from upstream code from a later release (the driver code is not on stable/train), we'll need Dell EMC to identify the code change required to fix this downstream. Can you indicate the specific code in the (abandoned) upstream patch? Or, perhaps upload a patch file to this BZ.
Created attachment 1703074 [details] Fix for volume-attach
I see what happened. The driver was updated in the upstream patch [1] to address the CVE, and that patch needs to be applied to the code that was backported to 16.1. [1] https://review.opendev.org/733105
What do we do for certification? Apply this patch before running 16.1 certification and submit results? Is this acceptable to cert team?
Related patch https://review.opendev.org/#/c/746109/
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Moderate: openstack-cinder security update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2020:4283