Comment 1 for bug 1929262

Revision history for this message
Nobuto Murata (nobuto) wrote :

Subscribing ~field-high. It's hitting field deployments. It's not a critical blocker, but the charm needs to react to the upstream change appropriately.
https://docs.ceph.com/en/latest/security/CVE-2021-20288/

Workaround: it's not technically a workaround, but for new deployments with up-to-date packages, the following command can be executed to set the recommended value by the upstream:
$ juju run --unit ceph-mon/leader -- \
    sudo ceph config set mon auth_allow_insecure_global_id_reclaim false
https://docs.ceph.com/en/latest/security/CVE-2021-20288/#recommendations

As a side note, in verification steps of SRU, it would be nice to check `ceph health` so we would have noticed this earlier.