(RHSA-2016:2848) Moderate: Red Hat Ceph Storage 1.3 security, bug fix, and enhancement update

Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable version of the Ceph storage system with a Ceph management platform, deployment utilities, and support services.

Security Fix(es):

• A flaw was found in the way Ceph Object Gateway handles POST object requests. An authenticated attacker could launch a denial of service attack by sending null or specially crafted POST object requests. (CVE-2016-8626)

Bug Fix(es):

• Dynamic Large Objects (DLOs) containing zero-length segments could cause the GET requests to enter an infinite loop or to fail depending on the position of the zero-length segment in an object, causing Ceph Object Gateway nodes to consume 100% of CPU. This bug has been fixed, and the GET requests succeed as expected in described situation. (BZ#1380196)

Enhancement(s):

• This update adds the “apply-layout-settings” command to the ceph-objectstore-tool utility. The new command enables users to perform collection splitting offline on OSD nodes in cases when doing it online would cause too large an impact. (BZ#1367441)

• With this update, it is possible to change the maximum number shards per bucket. This is especially useful when bucket sharding was not configured correctly. (BZ#1378995)

All users of Red Hat Ceph Storage are advised to upgrade to these updated
packages.