Lucene search

K
mageiaGentoo FoundationMGASA-2021-0126
HistoryMar 12, 2021 - 4:25 a.m.

Updated ceph packages fix security vulnerabilities

2021-03-1204:25:47
Gentoo Foundation
advisories.mageia.org
17

0.001 Low

EPSS

Percentile

22.0%

A flaw was found in Ceph where Ceph stores mgr module passwords in clear text. This issue can be found by searching the mgr logs for Grafana and dashboard with passwords visible. The highest threat from this vulnerability is to confidentiality (CVE-2020-25678). A flaw was found in ceph-dashboard. The JSON Web Token (JWT) used for user authentication is stored by the frontend application in the browser’s localStorage which is potentially vulnerable to attackers via XSS attacks. The highest threat from this vulnerability is to data confidentiality and integrity (CVE-2020-27839).

OSVersionArchitecturePackageVersionFilename
Mageia8noarchceph< 15.2.9-1ceph-15.2.9-1.mga8