[Medium] Patch ceph to fix CVE-2014-5461

[kevin-b-lockwood]

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

• The toolchain has been rebuilt successfully (or no changes were made to it)
• The toolchain/worker package manifests are up-to-date
• Any updated packages successfully build (or no packages were changed)
• Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
• Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
• All package sources are available
• cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
• LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
• All source files have up-to-date hashes in the *.signatures.json files
• sudo make go-tidy-all and sudo make go-test-coverage pass
• Documentation has been updated to match any changes to the build system
• Ready to merge

---

Summary

Fix CVE-2014-5461

Change Log

• May not be required as per Ceph CVE Fixes - Removing "jaegertracing/opentelemetry-cpp" as it was not being built #11999 : 448eeea
• Patch CVE-2014-5461

Does this affect the toolchain?

NO

Links to CVEs

• https://nvd.nist.gov/vuln/detail/CVE-2014-5461

Test Methodology

• Local build

[sameluch]

@kevin-b-lockwood can you combine this and these two other PRs? we will hit merge conflicts if we try to take any of these changes individually.
#12105
#11896

[kevin-b-lockwood]

@kevin-b-lockwood can you combine this and these two other PRs? we will hit merge conflicts if we try to take any of these changes individually. #12105 #11896

Ok, I have added commits for #12105, #11896, and the new #12104. I can drop that one if desired.

[sameluch]

/AzurePipelines run

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[kevin-b-lockwood]

@sameluch How do I go about fixing these toolchain issues? It builds fine on my machine so I'm looking for a way to check this stuff. Maybe the toolchain jsons have changed in fasttrack/3.0 and I need to merge in those changes?

[sameluch]

@sameluch How do I go about fixing these toolchain issues? It builds fine on my machine so I'm looking for a way to check this stuff. Maybe the toolchain jsons have changed in fasttrack/3.0 and I need to merge in those changes?

yes, we recently checked in a change from Bala which updated python so the manifests changed. Updating the base branch and restarting the build should resolve the issue.

[sameluch]

/AzurePipelines run

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[sameluch]

@kevin-b-lockwood can you combine this and these two other PRs? we will hit merge conflicts if we try to take any of these changes individually. #12105 #11896

Ok, I have added commits for #12105, #11896, and the new #12104. I can drop that one if desired.

@kevin-b-lockwood can you close the other PRs for ceph CVEs in favor of just using this one for the moment?

[kevin-b-lockwood]

@kevin-b-lockwood can you combine this and these two other PRs? we will hit merge conflicts if we try to take any of these changes individually. #12105 #11896

Ok, I have added commits for #12105, #11896, and the new #12104. I can drop that one if desired.

@kevin-b-lockwood can you close the other PRs for ceph CVEs in favor of just using this one for the moment?

My apologies, I rebased after seeing your message but did not see that you merged first. Hopefully that is not to much of an issue. I will mark those other PRs as closed.

[sameluch]

@kevin-b-lockwood can you combine this and these two other PRs? we will hit merge conflicts if we try to take any of these changes individually. #12105 #11896

Ok, I have added commits for #12105, #11896, and the new #12104. I can drop that one if desired.

@kevin-b-lockwood can you close the other PRs for ceph CVEs in favor of just using this one for the moment?

My apologies, I rebased after seeing your message but did not see that you merged first. Hopefully that is not to much of an issue. I will mark those other PRs as closed.

No worries, I will kick off another build for this PR with the update.

[sameluch]

/AzurePipelines run

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[kevin-b-lockwood]

@sameluch I hate to bother you, but I can't actually see the test results due to permissions issues. I have no such test failures when I build it on my machine, so I'm struggling to fix these issues. Is there something I can do to get those permissions?

[sameluch]

@kevin-b-lockwood, this build looks good. The PR check build does some additional packages (generally whatever is in flight on the fasttrack branch already and any packages that depend on the updated package). The failures seen are all known failures, so we are going to take this change.

[kevin-b-lockwood]

Glad to hear it, I can worry about other PRs now.

[CBL-Mariner-Bot]

Auto cherry-pick results:

• 3.0-dev ✅ -> [AUTO-CHERRYPICK] [Medium] Patch ceph to fix CVE-2014-5461 - branch 3.0-dev #12193

Auto cherry-pick pipeline run -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=726030&view=results