[SRU] ceph 14.2.22

[Chris MacNaughton]

[Impact]
This release fixes several bugs. We would like to make sure all of our users have access to these improvements.

The update contains the following package updates:

   * ceph 14.2.22

[Test Case]
The following SRU process was followed:

https://wiki.ubuntu.com/OpenStackUpdates

In order to avoid regression of existing users, the OpenStack team will run their continuous integration test against the packages that are in -proposed. A successful run of all available tests will be required before the proposed packages can be let into -updates.

The OpenStack team will be in charge of attaching the output summary of the executed tests. The OpenStack team members will not mark ‘verification-done’ until this has happened.

[Regression Potential]
In order to mitigate the regression potential, the results of the
aforementioned tests are attached to this bug.

[Ponnuvel Palaniyappan (pponnuvel)]

The primary aim is to have a Nautilus release for fixing the
CVE 2021-20288 [0].

The fix for [0] went into 14.2.20. Since 142.22 has already been
released (upstream) and likely to be last point release in Nautlius,
it makes sense to target that.

[0] https://docs.ceph.com/en/latest/security/CVE-2021-20288/#cve-2021-20288-unauthorized-global-id-reuse-in-cephx

[James Page (james-page)]

Uploaded to train-staging - once built will promote to train-proposed for testing.

[James Page (james-page)]

Hello Chris, or anyone else affected,

Accepted ceph into train-proposed. The package will build now and be available in the Ubuntu Cloud Archive in a few hours, and then in the -proposed repository.

Please help us by testing this new package. To enable the -proposed repository:

  sudo add-apt-repository cloud-archive:train-proposed
  sudo apt-get update

Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-train-needed to verification-train-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-train-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[James Page (james-page)]

The verification of the Stable Release Update for ceph has completed successfully and the package has now been released to -updates. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[James Page (james-page)]

This bug was fixed in the package ceph - 14.2.22-0ubuntu0.19.10.1~cloud1
---------------

 ceph (14.2.22-0ubuntu0.19.10.1~cloud1) bionic; urgency=medium
 .
   * New upstream stable point release (LP: #1940959) including fix for:
     - CVE 2021-20288: Unauthorized global_id reuse in cephx.

[James Page (james-page)]

to confirm - train-proposed passed the regular distro-regression tempest testing as part of our regular scheduled distro-regression testing.