Security Bulletin: IBM Storage Ceph is vulnerable to a HTTP Request Smuggling vulnerablity in Golang (CVE-2022-1705)

Summary Golang is used by IBM Storage Ceph as part of RGW and in assorted other locations. CVE-2022-1705 Vulnerability Details CVEID:CVE-2022-1705 DESCRIPTION: Golang Go is vulnerable to HTTP request smuggling, caused by a flaw with accepting of some invalid Transfer-Encoding headers in the HTTP/...

Security Bulletin: IBM Storage Ceph is vulnerable to Use After Free in the RHEL UBI (CVE-2023-4813)

Summary RHEL UBI is used by IBM Storage Ceph as the base operating system. CVE-2023-4813 This bulletin identifies the steps to take to address the vulnerability in the RHEL UBI. Vulnerability Details CVEID:CVE-2023-4813 DESCRIPTION: glibc is vulnerable to a denial of service, caused by a...

Security Bulletin: IBM Storage Ceph is vulnerable to Double Free in the RHEL UBI (CVE-2023-39975)

Summary RHEL UBI is used by IBM Storage Ceph as the base operating system. CVE-2023-39975 This bulletin identifies the steps to take to address the vulnerability in RHEL. Vulnerability Details CVEID:CVE-2023-39975 DESCRIPTION: MIT Kerberos 5 aka krb5 is vulnerable to a denial of service, caused b...

Security Bulletin: IBM Storage Ceph is vulnerable to exposure of sensitive information to an unauthorized actor in Grafana (CVE-2022-31130)

Summary Grafana is used by IBM Storage Ceph as part of the dashboard to monitor the stats for each cluster. CVE-2022-31130 Vulnerability Details CVEID:CVE-2022-31130 DESCRIPTION: Grafana could allow a remote authenticated attacker to obtain sensitive information, caused by a flaw in the proxy...

Security Bulletin: IBM Storage Ceph is vulnerable to Use After Free in the RHEL UBI (CVE-2023-4806)

Summary RHEL UBI is used by IBM Storage Ceph as the base operating system. CVE-2023-4806 This bulletin identifies the steps to take to address the vulnerability in RHEL. Vulnerability Details CVEID:CVE-2023-4806 DESCRIPTION: GNU glibc is vulnerable to a denial of service, caused by a use-after-fr...

Security Bulletin: IBM Storage Ceph is vulnerable to Access of Uninitialized Pointer in the RHEL UBI (CVE-2023-36054)

Summary RHEL UBI is used by IBM Storage Ceph as the base operating system. This bulletin identifies the steps to take to address the vulnerability in RHEL. CVE-2023-36054 Vulnerability Details CVEID:CVE-2023-36054 DESCRIPTION: MIT Kerberos 5 aka krb5 is vulnerable to a denial of service, caused b...

Security Bulletin: IBM Storage Ceph is vulnerable to Improper Authentication in the RHEL UBI (CVE-2023-27536)

Summary RHEL UBI is used by IBM Storage Ceph as the base operating system. CVE-2023-27536 This bulletin identifies the steps to take to address the vulnerability in RHEL. Vulnerability Details CVEID:CVE-2023-27536 DESCRIPTION: cURL libcurl could allow a remote attacker to bypass security...

Security Bulletin: IBM Storage Ceph is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in the RHEL UBI (CVE-2023-28322)

Summary RHEL UBI is used by IBM Storage Ceph as the base operating system. CVE-2023-28322 This bulletin identifies the steps to take to address the vulnerability in RHEL. Vulnerability Details CVEID:CVE-2023-28322 DESCRIPTION: cURL libcurl could allow a remote attacker to bypass security...

Security Bulletin: IBM Storage Ceph is vulnerable to Out-of-bounds Read in the RHEL UBI (CVE-2023-4527)

Summary RHEL UBI is used by IBM Storage Ceph as the base operating system. CVE-2023-4527 This bulletin identifies the steps to take to address the vulnerability in RHEL. Vulnerability Details CVEID:CVE-2023-4527 DESCRIPTION: glibc is vulnerable to a stack-based buffer overflow, caused by improper...

Security Bulletin: IBM Storage Ceph is vulnerable to Improper Authentication in the RHEL UBI (CVE-2023-27535)

Summary RHEL UBI is used by IBM Storage Ceph as the base operating system. CVE-2023-27535 This bulletin identifies the steps to take to address the vulnerability in RHEL. Vulnerability Details CVEID:CVE-2023-27535 DESCRIPTION: cURL libcurl could allow a remote attacker to bypass security...

Security Bulletin: IBM Storage Ceph is vulnerable to Out-of-bounds Write in the RHEL UBI (CVE-2023-38545)

Summary RHEL UBI is used by IBM Storage Ceph as the base operating system. CVE-2023-38545 This bulletin identifies the steps to take to address the vulnerability in RHEL. Vulnerability Details CVEID:CVE-2023-38545 DESCRIPTION: libcurl and cURL are vulnerable to a heap-based buffer overflow, cause...

Security Bulletin: IBM Storage Ceph is vulnerable to Path Traversal in the RHEL UBI (CVE-2023-27534)

Summary RHEL UBI is used by IBM Storage Ceph as the base operating system. CVE-2023-27534 This bulletin identifies the steps to take to address the vulnerability in the RHEL UBI. Vulnerability Details CVEID:CVE-2023-27534 DESCRIPTION: cURL libcurl could allow a remote attacker to obtain sensitive...

Security Bulletin: IBM Storage Ceph is vulnerable to Out-of-bounds Write in the RHEL UBI (CVE-2023-29491)

Summary RHEL UBI is used by IBM Storage Ceph as the base operating system. CVE-2023-29491 This bulletin identifies the steps to take to address the vulnerability in the RHEL UBI. Vulnerability Details CVEID:CVE-2023-29491 DESCRIPTION: ncurses is vulnerable to a denial of service, caused by a memo...

Security Bulletin: IBM Storage Ceph is vulnerable to Improper Authentication in the RHEL UBI (CVE-2023-27538)

Summary RHEL UBI is used by IBM Storage Ceph as the base operating system. CVE-2023-27538 This bulletin identifies the steps to take to address the vulnerability. Vulnerability Details CVEID: CVE-2023-27538 DESCRIPTION: cURL libcurl could allow a local attacker to bypass security restrictions,...

Security Bulletin: IBM Storage Ceph is vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in the RHEL UBI (CVE-2023-27533)

Summary RHEL UBI is used by IBM Storage Ceph as the base operating system. CVE-2023-27533 This bulletin identifies the steps to take to address the vulnerability in the RHEL UBI. Vulnerability Details CVEID: CVE-2023-27533 DESCRIPTION: cURL libcurl could allow a remote attacker to bypass security...

Security Bulletin: IBM Storage Ceph is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in the RHEL UBI (CVE-2023-32681)

Summary RHEL UBI is used by IBM Storage Ceph as the base operating system. CVE-2023-32681 This bulletin identifies the steps to take to address the vulnerability in the RHEL UBI. Vulnerability Details CVEID: CVE-2023-32681 DESCRIPTION: python-requests could allow a remote attacker to obtain...

Security Bulletin: IBM Storage Ceph is vulnerable to Improper Certificate Validation in the RHEL UBI (CVE-2023-28321)

Summary RHEL UBI is used by IBM Storage Ceph as the base operating system. CVE-2023-28321 This bulletin identifies the steps to take to address the vulnerability in the RHEL UBI. Vulnerability Details CVEID: CVE-2023-28321 DESCRIPTION: cURL libcurl could allow a remote attacker to bypass security...

Security Bulletin: IBM Storage Ceph is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Grafana (CVE-2023-1410)

Summary Grafana is used by IBM Storage Ceph as a monitoring dashboard. CVE-2023-1410 This bulletin identifies the steps to take to address the vulnerability in Grafana. Vulnerability Details CVEID: CVE-2023-1410 DESCRIPTION: Grafana is vulnerable to cross-site scripting, caused by improper...

Security Bulletin: IBM Storage Ceph is vulnerable to Improper Synchronization in Grafana (CVE-2023-2801)

Summary Grafana is used by IBM Storage Ceph as a monitoring dashboard. CVE-2023-2801 This bulletin identifies the steps to take to address the vulnerability in Grafana. Vulnerability Details CVEID: CVE-2023-2801 DESCRIPTION: Grafana is vulnerable to a denial of service, caused by a proxy race...

Security Bulletin: IBM Storage Ceph is vulnerable to Missing Authorization in Grafana (CVE-2023-2183)

Summary Grafana is used by IBM Storage Ceph as a monitoring dashboard. CVE-2023-2183 This bulletin identifies the steps to take to address the vulnerability in Grafana. Vulnerability Details CVEID: CVE-2023-2183 DESCRIPTION: Grafana could allow a remote authenticated attacker to obtain sensitive...