On Tue, Apr 20, 2021 at 2:02 AM David Galloway <dgallowa@redhat.com> wrote:

This is the first bugfix release in the Pacific stable series. It addresses a security vulnerability in the Ceph authentication framework. We recommend users to update to this release. For a detailed release notes with links & changelog please refer to the official blog entry at https://ceph.io/releases/v16-2-1-pacific-released

Security Fixes --------------

* This release includes a security fix that ensures the global_id value (a numeric value that should be unique for every authenticated client or daemon in the cluster) is reclaimed after a network disconnect or ticket renewal in a secure fashion. Two new health alerts may appear during the upgrade indicating that there are clients or daemons that are not yet patched with the appropriate fix.

The link in the blog entry should point at https://docs.ceph.com/en/latest/security/CVE-2021-20288/ Please refer there for details and recommendations. Thanks, Ilya