RepoMirrors/ceph
1
0
Fork 0
mirror of https://github.com/ceph/ceph synced 2025-01-03 09:32:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

doc/releases/octopus.rst: add note for CVE-2022-0670

Browse Source 
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
This commit is contained in:
Ilya Dryomov 2022-08-10 11:09:55 +02:00
parent 4588d4f431
commit 3d18110c2b
2 changed files with 19 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
doc/releases/octopus.rst
View File

@ -30,6 +30,24 @@ Notable Changes
or positional arguments is resurrected. Such invocations accidentally became
limited to just the default pool (``rbd_default_pool``) in v15.2.14.
* Users who were running OpenStack Manila to export native CephFS, who
upgraded their Ceph cluster from Nautilus (or earlier) to a later
major version, were vulnerable to an attack by malicious users
(:ref:`CVE-2022-0670`). The vulnerability allowed users to obtain
access to arbitrary portions of the CephFS filesystem hierarchy,
instead of being properly restricted to their own subvolumes. The
vulnerability is due to a bug in the "volumes" plugin in Ceph Manager.
This plugin is responsible for managing Ceph File System subvolumes
which are used by OpenStack Manila services as a way to provide shares
to Manila users.
With this release, the vulnerability is fixed. Administrators who are
concerned they may have been impacted should audit the CephX keys in
their cluster for proper path restrictions.
Again, this vulnerability only impacts OpenStack Manila clusters which
provided native CephFS access to their users.
Changelog
---------------

2
doc/security/CVE-2022-0670.rst
View File

@ -30,7 +30,7 @@ Fixed versions
* Quincy v17.2.2 (and later)
* Pacific v16.2.10 (and later)
* Octopus fix is forthcoming
* Octopus v15.2.17
Recommendations
---------------