As always, after it passed our internal testing, we will release the packages to our public repository servers. First to our Ceph test repository and if the greater public tested the release with no issues popping up, it will be pushed to our Ceph main repository.
Thanks for your tips. We have a Ceph test repo and a Ceph stable repo since many years, seems you missed this.?
Before we upload packages to any public repo, internal tests will be done. We never release untested packages to the public.
There are two fixes in the 14.2.7 release,
Because, just by using the Proxmox Integration you won't get in touch with those at all, FYI.
Due to the speciality of those two fixes, which are the only ones included in this release, and the possibility to reduce possible impact greatly, we do not see this as high priority.
We evaluate every release, it's impact and use it will have to Proxmox VE users, in this case it was clear that impact is not to be considered high as no default setup was affected and workarounds can be applied. The release will thus be done as normally, thoroughly tested and not rushed.
- one for ceph-dashboard, which we do not use or really support. An admin would need to enable the dashboard manually and an attacker would need to have access to the dashboard already to do anything here, at least the latter (exposing dashboards to the WAN) is not recommended in general.
- a issue within a specific RGW frontend, namely the "beast" one (which we have no integration for).
Because, just by using the Proxmox Integration you won't get in touch with those at all, FYI.
Due to the speciality of those two fixes, which are the only ones included in this release, and the possibility to reduce possible impact greatly, we do not see this as high priority.
We evaluate every release, it's impact and use it will have to Proxmox VE users, in this case it was clear that impact is not to be considered high as no default setup was affected and workarounds can be applied. The release will thus be done as normally, thoroughly tested and not rushed.
I have some doubts that this release only include the fixes mentioned above:
CVE-2020-1699
CVE-2020-1700
However, I don't understand how I can test this new release(s) if you don't provide it in your test repo.
Isn't this test repo for testing new releases?
CVE-2020-1699
CVE-2020-1700
However, I don't understand how I can test this new release(s) if you don't provide it in your test repo.
Isn't this test repo for testing new releases?
Those two CVEs are the exact two issues I describe. If you do not believe me then maybe the official release notes https://ceph.io/releases/v14-2-7-nautilus-released/ and/or the commit list between the 14.2.6 and the 14.2.7 release https://github.com/ceph/ceph/commits/v14.2.7 Just because there's a "CVE" it doesn't have to be bad for everyone, as said do you even use the ceph-mgr-dashboard, and is it available to the WAN? Same with RGW beast client? Because if not, that release will do absolutely nothing for you.
Yes, for publicly testing releases once we got done with internal testing and valued a release as important enough to start off the rumble of a new ceph release.
Read again the posts before and answer the question:
Do you even use the ceph-mgr-dashboard, and is it available to the WAN?