Workaround: it's not technically a workaround, but for new deployments with up-to-date packages, the following command can be executed to set the recommended value by the upstream:
$ juju run --unit ceph-mon/leader -- \
sudo ceph config set mon auth_allow_insecure_global_id_reclaim false https://docs.ceph.com/en/latest/security/CVE-2021-20288/#recommendations
As a side note, in verification steps of SRU, it would be nice to check `ceph health` so we would have noticed this earlier.
Subscribing ~field-high. It's hitting field deployments. It's not a critical blocker, but the charm needs to react to the upstream change appropriately. /docs.ceph. com/en/ latest/ security/ CVE-2021- 20288/
https:/
Workaround: it's not technically a workaround, but for new deployments with up-to-date packages, the following command can be executed to set the recommended value by the upstream: insecure_ global_ id_reclaim false /docs.ceph. com/en/ latest/ security/ CVE-2021- 20288/# recommendations
$ juju run --unit ceph-mon/leader -- \
sudo ceph config set mon auth_allow_
https:/
As a side note, in verification steps of SRU, it would be nice to check `ceph health` so we would have noticed this earlier.