Denial Of Service (Dos)

ceph is vulnerable to denial of service. There is no defined limit for ListBucket max-keys in the RGW codebase, allowing users to crash the application against OMAPs holding bucket indices...

Information Disclosure

ceph is vulnerable to information disclosure. An authenticated user with read-only permissions can steal dm-crypt/ LUKS key...

Moderate: Red Hat Security Advisory: Red Hat Ceph Storage 3.3 security, bug fix, and enhancement update

An update is now available for Red Hat Ceph Storage 3.3 on Ubuntu 16.04. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

ceph: authenticated user with read only permissions can steal dm-crypt / LUKS key

It was found that authenticated ceph user with read only permissions could steal dm-crypt encryption keys used in ceph disk encryption...

ceph: ListBucket max-keys has no defined limit in the RGW codebase

A flaw was found in the way the ListBucket function max-keys has no defined limit in the RGW codebase. An authenticated ceph RGW user can cause a denial of service attack against OMAPs holding bucked indices...

ceph: ListBucket max-keys has no defined limit in the RGW codebase

A flaw was found in the way the ListBucket function max-keys has no defined limit in the RGW codebase. An authenticated ceph RGW user can cause a denial of service attack against OMAPs holding bucked indices...

ceph: debug logging for v4 auth does not sanitize encryption keys

It was found that Ceph RGW did not properly sanitize encryption keys in debug logging for v4 auth. Encryption keys could be inadvertently disclosed when sharing debug logs...

Moderate: Red Hat Security Advisory: Red Hat Ceph Storage 3.3 security, bug fix, and enhancement update

An update is now available for Red Hat Ceph Storage 3.3 on Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

ceph: authenticated user with read only permissions can steal dm-crypt / LUKS key

It was found that authenticated ceph user with read only permissions could steal dm-crypt encryption keys used in ceph disk encryption...

SUSE SLED15 / SLES15 Security Update : ceph (SUSE-SU-2019:2049-1)

This update for ceph fixes the following issues : Security issues fixed : CVE-2019-3821: civetweb: fix file descriptor leak bsc1125080 CVE-2018-16889: rgw: sanitize customer encryption keys from log output in v4 auth bsc1121567 Non-security issues fixed: install grafana dashboards world readable...

SUSE-SU-2019:2049-1 Security update for ceph

This update for ceph fixes the following issues: Security issues fixed: - CVE-2019-3821: civetweb: fix file descriptor leak bsc1125080 - CVE-2018-16889: rgw: sanitize customer encryption keys from log output in v4 auth bsc1121567 Non-security issues fixed: - install grafana dashboards world...

EulerOS 2.0 SP8 : ceph (EulerOS-SA-2019-1791)

According to the version of the ceph packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A flaw was found in the way the ListBucket function max-keys has no defined limit in the RGW codebase. An authenticated ceph RGW user can cause a...

OPENSUSE-SU-2019:1755-1 Security update for samba

This update for samba fixes the following issues: Security issues fixed: - CVE-2019-12435: zone operations can crash rpc server; bso13922; bsc1137815. Other issues fixed: - Fix cephwrapflistxattr debug message; bso13940; bsc1134697. - Add cephsnapshots VFS module; jscSES-183. - Fix vfsceph...

Security update for samba (important)

openSUSE Security Update: Security update for samba Announcement ID: openSUSE-SU-2019:1755-1 Rating: important References: 1125601 1130245 1134452 1134697 1137815 Cross-References: CVE-2019-12435 Affected Products: openSUSE Leap 15.1 An update that solves one vulnerability and has four fixes is n...

SUSE-SU-2019:1862-1 Security update for ardana and crowbar

This update for ardana and crowbar fixes the following issues: - Restrict rootwrap directories for cinder bsc1132542 - Change Cinder default log level from DEBUG to INFO SCRD-7132 - Remove configuration from migration bsc1126391 - Configurable innodb flush options SCRD-7496 - Secure designate's...

libxslt CVE-2019-13117 Information Disclosure Vulnerability

Description libxslt is prone to an information-disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may aid in further attacks. libxslt 1.1.33 is vulnerable; other versions may also be affected. Technologies Affected Oracle JDKLinux Production Release...

Ubuntu: Security Advisory (USN-4035-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 16.04 LTS : Ceph vulnerabilities (USN-4035-1)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4035-1 advisory. It was discovered that Ceph incorrectly handled read only permissions. An authenticated attacker could use this issue to obtain dm-crypt encryption keys...

USN-4035-1: Ceph vulnerabilities

It was discovered that Ceph incorrectly handled read only permissions. An authenticated attacker could use this issue to obtain dm-crypt encryption keys. This issue only affected Ubuntu 16.04 LTS. CVE-2018-14662 It was discovered that Ceph incorrectly handled certain OMAPs holding bucket indices...

USN-4035-1 ceph vulnerabilities

It was discovered that Ceph incorrectly handled read only permissions. An authenticated attacker could use this issue to obtain dm-crypt encryption keys. This issue only affected Ubuntu 16.04 LTS. CVE-2018-14662 It was discovered that Ceph incorrectly handled certain OMAPs holding bucket indices...