feat(oci/ceph)!: Update v19.2.6 ➼ v20.2.4

[tinfoild]

This PR contains the following updates:

Package	Update	Change
quay.io/ceph/ceph	major	v19.2.6 → v20.2.4

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Configuration

📅 Schedule: (in timezone Asia/Singapore)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[cloudflare-workers-and-pages]

Deploying jjgadgets-biohazard with    Cloudflare Pages

Latest commit:	00d37bb
Status:	🚫  Build failed.

View logs

[tinfoild]

kube/helmrelease/out00

--- HelmRelease: rook-ceph/rook-ceph-cluster-biohazard CephCluster: rook-ceph/biohazard

+++ HelmRelease: rook-ceph/rook-ceph-cluster-biohazard CephCluster: rook-ceph/biohazard

@@ -5,13 +5,13 @@

   name: biohazard
   namespace: rook-ceph
 spec:
   monitoring:
     enabled: true
   cephVersion:
-    image: quay.io/ceph/ceph:v19.2.6@sha256:ff836bb28e7d0be0ec4dd22e79407174452a96e11ee62e9cdd1fa47f4bcc3bdc
+    image: quay.io/ceph/ceph:v20.2.4@sha256:6bb1c8a42fbc0bf87938946990b65174466997bc11c31eb5a323225a779fd8f9
     allowUnsupported: false
   cleanupPolicy:
     allowUninstallWithVolumes: false
     confirmation: ''
     sanitizeDisks:
       dataSource: zero
--- HelmRelease: piped/piped Deployment: piped/piped-frontend

+++ HelmRelease: piped/piped Deployment: piped/piped-frontend

@@ -60,13 +60,13 @@

       containers:
       - env:
         - name: BACKEND_HOSTNAME
           value: piped
         - name: TZ
           value: null
-        image: jank.ing/jjgadgets/piped-frontend:rolling@sha256:4d17fbf8fa19422e5b4c85321899c0c803d1e15559c2497e3859d361043b01b2
+        image: jank.ing/jjgadgets/piped-frontend:rolling@sha256:5664f8ae2658c27850ad918de6b87622652d7ae471086657fb61734566c144e5
         livenessProbe:
           failureThreshold: 3
           initialDelaySeconds: 0
           periodSeconds: 10
           tcpSocket:
             port: 8080

[tinfoild]

kube/kustomization/out00

--- kube/deploy/core/storage/rook-ceph/cluster/biohazard Kustomization: flux-system/1-core-storage-rook-ceph-cluster HelmRelease: rook-ceph/rook-ceph-cluster-biohazard

+++ kube/deploy/core/storage/rook-ceph/cluster/biohazard Kustomization: flux-system/1-core-storage-rook-ceph-cluster HelmRelease: rook-ceph/rook-ceph-cluster-biohazard

@@ -144,13 +144,13 @@

       deletionPolicy: Delete
       enabled: true
       isDefault: true
       name: block
     cephClusterSpec:
       cephVersion:
-        image: quay.io/ceph/ceph:v18.2.8@sha256:69cbef90eb58cf96e572e7497227a2bcb0ec9175bc2247809c0a37857db9b820
+        image: quay.io/ceph/ceph:v20.2.3@sha256:d195020de02512030118e772cef7859e92904e91eb4cb21acb503f8b94118137
       crashCollector:
         disable: true
       dashboard:
         enabled: true
         prometheusEndpoint: http://vmsingle-victoria.monitoring.svc.cluster.local:8429
         ssl: false

[tinfoild]

kube/kustomization/out00

--- kube/deploy/core/storage/rook-ceph/cluster/biohazard Kustomization: flux-system/1-core-storage-rook-ceph-cluster HelmRelease: rook-ceph/rook-ceph-cluster-biohazard

+++ kube/deploy/core/storage/rook-ceph/cluster/biohazard Kustomization: flux-system/1-core-storage-rook-ceph-cluster HelmRelease: rook-ceph/rook-ceph-cluster-biohazard

@@ -87,13 +87,13 @@

       deletionPolicy: Delete
       enabled: true
       isDefault: true
       name: block
     cephClusterSpec:
       cephVersion:
-        image: quay.io/ceph/ceph:v18.2.7@sha256:1b9158ce28975f95def6a0ad459fa19f1336506074267a4b47c1bd914a00fec0
+        image: quay.io/ceph/ceph:v20.1.0@sha256:ded43bb35add6b79df49a86b5c91a16f3d4d137665f6f1a722b4739386da6f12
       crashCollector:
         disable: true
       dashboard:
         enabled: true
         prometheusEndpoint: http://vmsingle-victoria.monitoring.svc.cluster.local:8429
         ssl: false

[ciel-shieru]

SECURITY VULNERABILITIES FOUND BY CIEL

📅 Scan date: 2026-07-24 09:29 SGT
🤖 Scanner: Ciel Security Scanner
🔗 PR: #3381 — Update v18.2.8 ➼ v20.2.2
📦 Packages checked: 1
🔍 Sources: NVD, OSV.dev, GHSA, GHSL, CISA KEV, FortiGuard, CVE.org, Changelog
⚠️ Vulnerabilities found: 2 (both in old version)

---

Severity Summary

Severity	Count
CRITICAL	0
HIGH	2
MEDIUM / MODERATE	0
LOW	0
UNKNOWN / NEEDS VERIFICATION	0
Total	2

---

Results

Package: quay.io/ceph/ceph

• Ecosystem: Container (Docker)
• Old version: v18.2.8 — VULNERABLE (2 CVEs)
• New version: v20.2.2 — CLEAN

Vulnerabilities in version v18.2.8

1. CVE-2024-48916 / GHSA-5g9m-mmp6-93mq — Severity: HIGH (CVSS 8.1)

   • Description: Authentication bypass through RadosGW OIDC provider accepting JWT "none" algorithm.
   • Affected versions: <= 19.2.3
   • Fixed in: > 19.2.3
   • Sources: OSV, NVD, GHSA
   • Evidence: https://nvd.nist.gov/vuln/detail/CVE-2024-48916 | https://github.com/advisories/GHSA-5g9m-mmp6-93mq
   • Status: ✅ Fixed in newer versions

2. CVE-2024-47866 / GHSA-mgrm-g92q-f8h8 — Severity: HIGH (CVSS 7.5)

   • Description: RGW DoS attack via empty HTTP header in S3 object copy using x-amz-copy-source.
   • Affected versions: <= 19.2.3
   • Fixed in: > 19.2.3
   • Sources: OSV, NVD, GHSA
   • Evidence: https://nvd.nist.gov/vuln/detail/CVE-2024-47866 | https://github.com/advisories/GHSA-mgrm-g92q-f8h8
   • Status: ✅ Fixed in newer versions

Vulnerabilities in version v20.2.2

No known vulnerabilities found.

Changelog Security Highlights (v18.2.8 → v20.2.2)

• v18.2.8 (Reef EOL) — Fixed unprivileged sgid/suid modification in CephFS; SMTP SSL context enforced in mgr/alerts (GHSA-xj9f-7g59-m4jx)
• v19.2.x (Squid) — Multiple security backports including RGW auth fixes, OIDC hardening, and CVE-2024-47866/CVE-2024-48916 remediations
• v20.2.2 (Tentacle) — Use-after-free fixes in linger operations; RGW lifecycle and data integrity fixes

---

Recommendations

• MERGE PRIORITY: HIGH — The old version (v18.2.8) has 2 HIGH-severity vulnerabilities (CVE-2024-48916 auth bypass, CVE-2024-47866 RGW DoS) remediated in v20.2.2. Ceph Reef (v18.x) is also End of Life since March 2025 and will receive no further security patches.
• No new vulnerabilities introduced by v20.2.2.
• Merge this PR promptly to remediate both exposed vulnerabilities and move to a supported Ceph release series.

---

⚠️ This comment was posted by an automated security scanner (Ciel).
To re-scan, trigger the renovate-security-scanner skill.