[SRU] ceph 15.2.12

[James Page]

[Impact]
This release fixes several bugs. We would like to make sure all of our users have access to these improvements.

The update contains the following package updates:

   * ceph 15.2.12

[Test Case]
The following SRU process was followed:

https://wiki.ubuntu.com/OpenStackUpdates

In order to avoid regression of existing users, the OpenStack team will run their continuous integration test against the packages that are in -proposed. A successful run of all available tests will be required before the proposed packages can be let into -updates.

The OpenStack team will be in charge of attaching the output summary of the executed tests. The OpenStack team members will not mark ‘verification-done’ until this has happened.

[Regression Potential]
In order to mitigate the regression potential, the results of the
aforementioned tests are attached to this bug.

[Upstream release announcement]

V15.2.12 OCTOPUS

This is a hotfix release addressing a number of security issues and regressions. We recommend all users update to this release.

CHANGELOG
mgr/dashboard: fix base-href: revert it to previous approach (issue#50684, Avan Thakkar)

mgr/dashboard: fix cookie injection issue (CVE-2021-3509: Dashboard XSS via token cookie, Ernesto Puerta)

rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531: Swift API denial of service, Felix Huettner)

rgw: sanitize r in s3 CORSConfiguration’s ExposeHeader (CVE-2021-3524: HTTP header injects via CORS in RGW, Sergey Bobrov, Casey Bodley)

[Łukasz Zemczak (sil2100)]

Hey James! Since this feels like a security update, should we aim for getting it released into -security as well? In that case we'd have to inform the ubuntu-security team, build the packages in a security-enabled PPA and only the binary-copy the packages into -proposed.

[Brian Murray (brian-murray)]

An upload of ceph to groovy-proposed has been rejected from the upload queue for the following reason: "I've rejected this for groovy due to unanswered questions about it being a security update and with groovy nearing EoL.".

[James Page (james-page)]

This is being delivered as a security update but for the record:

groovy proposed

======
Totals
======
Ran: 99 tests in 2821.2720 sec.
 - Passed: 89
 - Skipped: 9
 - Expected Fail: 0
 - Unexpected Success: 0
 - Failed: 1
Sum of execute time for each test: 721.1389 sec.

Failing test is an expected test failure:

octavia_tempest_plugin.tests.scenario.v2.test_traffic_ops.TrafficOperationsScenarioTest

Octavia is still be enabled fully in our SRU testing.

[James Page (james-page)]

focal proposed

======
focal security proposed

Totals
======
Ran: 99 tests in 2801.2498 sec.
 - Passed: 89
 - Skipped: 9
 - Expected Fail: 0
 - Unexpected Success: 0
 - Failed: 1
Sum of execute time for each test: 794.2676 sec.

Failing test is an expected test failure:

octavia_tempest_plugin.tests.scenario.v2.test_traffic_ops.TrafficOperationsScenarioTest

Octavia is still be enabled fully in our SRU testing.

[Launchpad Janitor (janitor)]

This bug was fixed in the package ceph - 15.2.12-0ubuntu0.20.10.1

---------------
ceph (15.2.12-0ubuntu0.20.10.1) groovy-security; urgency=medium

  * SECURITY UPDATE: New upstream release (LP: #1929179):
    - CVE-2021-3509: Dashboard XSS via token cookie.
    - CVE-2021-3531: Swift API denial of service.
    - CVE-2021-3531: HTTP header injects via CORS in RGW.

 -- James Page <email address hidden> Mon, 24 May 2021 16:05:29 +0100

[Launchpad Janitor (janitor)]

This bug was fixed in the package ceph - 15.2.12-0ubuntu0.20.04.1

---------------
ceph (15.2.12-0ubuntu0.20.04.1) focal-security; urgency=medium

  * SECURITY UPDATE: New upstream release (LP: #1929179):
    - CVE-2021-3509: Dashboard XSS via token cookie.
    - CVE-2021-3531: Swift API denial of service.
    - CVE-2021-3531: HTTP header injects via CORS in RGW.

 -- James Page <email address hidden> Mon, 24 May 2021 16:07:20 +0100

[James Page (james-page)]

Hello James, or anyone else affected,

Accepted ceph into ussuri-proposed. The package will build now and be available in the Ubuntu Cloud Archive in a few hours, and then in the -proposed repository.

Please help us by testing this new package. To enable the -proposed repository:

  sudo add-apt-repository cloud-archive:ussuri-proposed
  sudo apt-get update

Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-ussuri-needed to verification-ussuri-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-ussuri-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[James Page (james-page)]

bionic/ussuri-proposed

======
Totals
======
Ran: 99 tests in 1592.9320 sec.
 - Passed: 90
 - Skipped: 9
 - Expected Fail: 0
 - Unexpected Success: 0
 - Failed: 0
Sum of execute time for each test: 604.7059 sec.

[James Page (james-page)]

The verification of the Stable Release Update for ceph has completed successfully and the package has now been released to -updates. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[James Page (james-page)]

This bug was fixed in the package ceph - 15.2.12-0ubuntu0.20.04.1~cloud0
---------------

 ceph (15.2.12-0ubuntu0.20.04.1~cloud0) bionic-ussuri; urgency=medium
 .
   * New upstream release for the Ubuntu Cloud Archive.
 .
 ceph (15.2.12-0ubuntu0.20.04.1) focal-security; urgency=medium
 .
   * SECURITY UPDATE: New upstream release (LP: #1929179):
     - CVE-2021-3509: Dashboard XSS via token cookie.
     - CVE-2021-3531: Swift API denial of service.
     - CVE-2021-3531: HTTP header injects via CORS in RGW.

[Frank Villaro (f-ran-k)]

Hi, I've created the related issue https://bugs.launchpad.net/ubuntu/+source/ceph/+bug/1946653 because I _think_ that the ceph source used to build the package is 15.2.13 instead of 15.2.12