[Medium] Patch ceph to fix CVE-2014-5461

[kevin-b-lockwood]

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

• The toolchain has been rebuilt successfully (or no changes were made to it)
• The toolchain/worker package manifests are up-to-date
• Any updated packages successfully build (or no packages were changed)
• Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
• Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
• All package sources are available
• cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
• LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
• All source files have up-to-date hashes in the *.signatures.json files
• sudo make go-tidy-all and sudo make go-test-coverage pass
• Documentation has been updated to match any changes to the build system
• Ready to merge

---

Summary

Fix CVE-2014-5461

Change Log

• May not be required as per Ceph CVE Fixes - Removing "jaegertracing/opentelemetry-cpp" as it was not being built #11999 : 448eeea
• Patch CVE-2014-5461

Does this affect the toolchain?

NO

Links to CVEs

• https://nvd.nist.gov/vuln/detail/CVE-2014-5461

Test Methodology

• Local build

[sameluch]

@kevin-b-lockwood can you combine this and these two other PRs? we will hit merge conflicts if we try to take any of these changes individually.
#12105
#11896

[kevin-b-lockwood]

@kevin-b-lockwood can you combine this and these two other PRs? we will hit merge conflicts if we try to take any of these changes individually. #12105 #11896

Ok, I have added commits for #12105, #11896, and the new #12104. I can drop that one if desired.

[sameluch]

/AzurePipelines run

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[kevin-b-lockwood]

@sameluch How do I go about fixing these toolchain issues? It builds fine on my machine so I'm looking for a way to check this stuff. Maybe the toolchain jsons have changed in fasttrack/3.0 and I need to merge in those changes?

[sameluch]

@sameluch How do I go about fixing these toolchain issues? It builds fine on my machine so I'm looking for a way to check this stuff. Maybe the toolchain jsons have changed in fasttrack/3.0 and I need to merge in those changes?

yes, we recently checked in a change from Bala which updated python so the manifests changed. Updating the base branch and restarting the build should resolve the issue.

[sameluch]

/AzurePipelines run

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[sameluch]

@kevin-b-lockwood can you combine this and these two other PRs? we will hit merge conflicts if we try to take any of these changes individually. #12105 #11896

Ok, I have added commits for #12105, #11896, and the new #12104. I can drop that one if desired.

@kevin-b-lockwood can you close the other PRs for ceph CVEs in favor of just using this one for the moment?

[kevin-b-lockwood]

@kevin-b-lockwood can you combine this and these two other PRs? we will hit merge conflicts if we try to take any of these changes individually. #12105 #11896

Ok, I have added commits for #12105, #11896, and the new #12104. I can drop that one if desired.

@kevin-b-lockwood can you close the other PRs for ceph CVEs in favor of just using this one for the moment?

My apologies, I rebased after seeing your message but did not see that you merged first. Hopefully that is not to much of an issue. I will mark those other PRs as closed.

[sameluch]

@kevin-b-lockwood can you combine this and these two other PRs? we will hit merge conflicts if we try to take any of these changes individually. #12105 #11896

Ok, I have added commits for #12105, #11896, and the new #12104. I can drop that one if desired.

@kevin-b-lockwood can you close the other PRs for ceph CVEs in favor of just using this one for the moment?

My apologies, I rebased after seeing your message but did not see that you merged first. Hopefully that is not to much of an issue. I will mark those other PRs as closed.

No worries, I will kick off another build for this PR with the update.

[sameluch]

/AzurePipelines run

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).