Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

This project is now read‑only. Starting Monday, February 2, please use https://ibm-ceph.atlassian.net/ for all bug tracking management.

Bug 2170208

Summary:	rebuild ceph container for Important sudo RHSA
Product:	[Red Hat Storage] Red Hat Ceph Storage	Reporter:	Ken Dreyer (Red Hat) <kdreyer>
Component:	Container	Assignee:	Ken Dreyer (Red Hat) <kdreyer>
Status:	CLOSED ERRATA	QA Contact:	Vaibhav Mahajan <vamahaja>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	5.3	CC:	ceph-eng-bugs, cephqe-warriors, vamahaja, vereddy
Target Milestone:	---
Target Release:	5.3z1
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	registry-proxy.engineering.redhat.com/rh-osbs/rhceph:ceph-5.3-rhel-8-containers-candidate-18485-20230215173828	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-02-28 10:09:44 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Ken Dreyer (Red Hat) 2023-02-15 21:08:49 UTC

The rhceph/rhceph-5-rhel8:latest container includes a sudo package that is vulnerable to an Important CVE.

Important CVE-2023-22809 https://access.redhat.com/errata/RHSA-2023:0284 sudo

Vulnerable package versions:
  sudo-1.8.29-8.el8

Public Container Ecosystem Catalog entry: https://catalog.redhat.com/software/containers/registry/registry.access.redhat.com/repository/rhceph/rhceph-5-rhel8

This bug tracks rebuilding the ceph container image against the newer RHEL base container image with the fixed packages.

Comment 1 RHEL Program Management 2023-02-15 21:09:00 UTC

Please specify the severity of this bug. Severity is defined here:
https://bugzilla.redhat.com/page.cgi?id=fields.html#bug_severity.

Comment 11 errata-xmlrpc 2023-02-28 10:09:44 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Red Hat Ceph Storage 5.3 Bug Fix update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2023:0981