Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

This project is now read‑only. Starting Monday, February 2, please use https://ibm-ceph.atlassian.net/ for all bug tracking management.

Bug 2256938

Summary:	rebuild ceph container for Important glibc, nghttp2, and python3 RHSAs
Product:	[Red Hat Storage] Red Hat Ceph Storage	Reporter:	Justin Caratzas <jcaratza>
Component:	Container	Assignee:	Ken Dreyer (Red Hat) <kdreyer>
Status:	CLOSED ERRATA	QA Contact:	Pranav Prakash <prprakas>
Severity:	urgent	Docs Contact:
Priority:	unspecified
Version:	5.3	CC:	ceph-eng-bugs, cephqe-warriors, saraut, vereddy
Target Milestone:	---
Target Release:	5.3z6
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	rhceph-container-5-499	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2024-02-08 16:58:28 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Justin Caratzas 2024-01-05 12:48:15 UTC

The rhceph/rhceph-5-rhel8:latest container includes glibc, nghttp2, and python3 packages that are vulnerable to Important CVEs.

Important CVE-2023-4911 https://access.redhat.com/errata/RHSA-2023:5455 glibc
Important CVE-2023-4527 https://access.redhat.com/errata/RHSA-2023:5455 glibc
Important CVE-2023-4806 https://access.redhat.com/errata/RHSA-2023:5455 glibc
Important CVE-2023-4813 https://access.redhat.com/errata/RHSA-2023:5455 glibc
Important CVE-2023-44487 https://access.redhat.com/errata/RHSA-2023:5837 nghttp2
Important CVE-2023-40217 https://access.redhat.com/errata/RHSA-2023:5997 python3

Vulnerable package versions:
  glibc-2.28-225.el8
  glibc-common-2.28-225.el8
  glibc-minimal-langpack-2.28-225.el8
  libnghttp2-1.33.0-3.el8_2.1
  platform-python-3.6.8-51.el8_8.1
  platform-python-devel-3.6.8-51.el8_8.1
  python3-libs-3.6.8-51.el8_8.1

Public Container Ecosystem Catalog entry: https://catalog.redhat.com/software/containers/registry/registry.access.redhat.com/repository/rhceph/rhceph-5-rhel8

You can find the fixed package versions by clicking each RHSA link above and looking at the "Updated Packages" tab.

This bug tracks rebuilding the ceph container image against the newer RHEL base container image with the fixed packages.

Comment 1 RHEL Program Management 2024-01-05 12:48:27 UTC

Please specify the severity of this bug. Severity is defined here:
https://bugzilla.redhat.com/page.cgi?id=fields.html#bug_severity.

Comment 2 Justin Caratzas 2024-01-25 11:45:46 UTC

Requesting QA Ack so we can add this to the 5.3 container errata

Comment 6 errata-xmlrpc 2024-02-08 16:58:28 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Important: new container image: rhceph-5.3), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2024:0746