Security Bulletin: IBM Storage Ceph is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross Site Scripting') in Bootstrap (CVE-2018-20677)

Summary Bootstrap is used by IBM Storage Ceph as a CSS framework. CVE-2018-20677 This bulletin identifies the steps to take to address the vulnerability in Bootstrap. Vulnerability Details CVEID: CVE-2018-20677 DESCRIPTION: Bootstrap is vulnerable to cross-site scripting, caused by improper...

Security Bulletin: IBM Storage Ceph is vulnerable to Use After Free in RHEL (CVE-2022-43552 )

Summary RHEL is used by IBM Storage Ceph as the base operating system. CVE-2022-43552 This bulletin identifies the steps to take to address the vulnerability in the RHEL UBI. Vulnerability Details CVEID: CVE-2022-43552 DESCRIPTION: cURL libcurl is vulnerable to a denial of service, caused by a...

Security Bulletin: IBM Storage Ceph is vulnerable to Cross Site Scripting in Grafana (CVE-2022-39324)

Summary Grafana is used by IBM Storage Ceph as part of the dashboard to monitor the stats for each cluster. CVE-2022-39324 This bulletin identifies the steps to take to address the vulnerability in Grafana. Vulnerability Details CVEID:CVE-2022-39324 DESCRIPTION: Grafana could allow a remote...

Security Bulletin: IBM Storage Ceph is vulnerable to Prototype Pollution in Ramda [CVE-2021-42581]

Summary Ramda is used by IBM Storage Ceph as part of the dashboard and in assorted other locations. CVE-2021-42581 This bulletin identifies the steps to take to address the vulnerability in Ramda. Vulnerability Details CVEID:CVE-2021-42581 DESCRIPTION: Ramda could allow a remote attacker to execu...

Security Bulletin: IBM Storage Ceph is vulnerable to improper authentication in Crewjam/SAML [CVE-2022-41912]

Summary Crewjam/SAML is used by IBM Storage Ceph as part of RGW and in assorted other locations CVE-2022-41912 This bulletin identifies the steps to take to address the vulnerability in Crewjam/SAML. Vulnerability Details CVEID:CVE-2022-41912 DESCRIPTION: Crewjam saml could allow a remote attacke...

Security Bulletin: IBM Storage Ceph is vulnerable to Incorrect privilege assignment in Golang (CVE-2022-29526)

Summary Golang is used by IBM Storage Ceph as part of RGW and in assorted other locations. CVE-2022-29526 Vulnerability Details CVEID:CVE-2022-29526 DESCRIPTION: Golang Go could allow a remote attacker to obtain sensitive information, caused by a flaw in the Faccessat function when called with a...

Security Bulletin: IBM Storage Ceph is vulnerable to uncontrolled recursion in Golang (CVE-2022-30630)

Summary Golang is used by IBM Storage Ceph as part of RGW and in assorted other locations. CVE-2022-30630 Vulnerability Details CVEID:CVE-2022-30630 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by an uncontrolled recursion flaw in Glob in io/fs due to stack exhaustion. By...

Security Bulletin: IBM Storage Ceph is vulnerable to Cross-site Scripting in Grafana (CVE-2023-22462)

Summary Grafana is used by IBM Storage Ceph as part of the dashboard to monitor the stats for each cluster. CVE-2023-22462 Vulnerability Details CVEID: CVE-2023-22462 DESCRIPTION: Grafana is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the Text plugi...

Security Bulletin: IBM Storage Ceph is vulnerable to Improper Input Validation in Curl (CVE-2022-35252)

Summary Curl is used by IBM Storage Ceph as part of RHEL, the base operating system. CVE-2022-35252 Vulnerability Details CVEID: CVE-2022-35252 DESCRIPTION: cURL libcurl is vulnerable to a denial of service, caused by a flaw when cookies contain control codes are later sent back to an HTTPS serve...

Security Bulletin: IBM Storage Ceph is vulnerable to Cross-site Scripting in Grafana (CVE-2022-21702 )

Summary Grafana is used by IBM Storage Ceph as part of the dashboard to monitor the stats for each cluster. CVE-2022-21702 Vulnerability Details CVEID: CVE-2022-21702 DESCRIPTION: Grafana is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the Grafana...

Security Bulletin: IBM Storage Ceph is vulnerable to Cross-site Scripting in Grafana (CVE-2023-0594)

Summary Grafana is used by IBM Storage Ceph as part of the dashboard to monitor the stats for each cluster. CVE-2023-0594 Vulnerability Details CVEID: CVE-2023-0594 DESCRIPTION: Grafana is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the TraceView...

Security Bulletin: IBM Storage Ceph is vulnerable to Cross-Site Request Forgery in Grafana (CVE-2022-21703)

Summary Grafana is used by IBM Storage Ceph as part of the dashboard to monitor the stats for each cluster. CVE-2022-21703 Vulnerability Details CVEID: CVE-2022-21703 DESCRIPTION: Grafana is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By...

Security Bulletin: IBM Storage Ceph is vulnerable via use of insufficiently random values and via exposure of sensitive information to an unauthorized actor in Golang (CVE-2022-30629)

Summary Golang is used by IBM Storage Ceph as part of RGW and in assorted other locations. CVE-2022-30629 Vulnerability Details CVEID: CVE-2022-30629 DESCRIPTION: Golang Go could allow a remote attacker to obtain sensitive information, caused by an issue with session tickets generated by crypto/t...

Security Bulletin: IBM Storage Ceph is vulnerable to a path traversal vulnerablity in Moment.js (CVE-2022-24785)

Summary Moment.js is used within the IBM Storage Ceph Dashboard and in assorted other locations. CVE-2022-24785 Vulnerability Details CVEID: CVE-2022-24785 DESCRIPTION: Moment.js could allow a remote attacker to traverse directories on the system, caused by improper validation of user supplied...

Security Bulletin: IBM Storage Ceph is vulnerable to 'Cross-site Scripting' in Grafana (CVE-2023-0507)

Summary Grafana is used by IBM Storage Ceph as part of the dashboard to monitor the stats for each cluster. CVE-2023-0507 Vulnerability Details CVEID: CVE-2023-0507 DESCRIPTION: Grafana is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the Geomap. A...

Security Bulletin: IBM Storage Ceph is vulnerable to a panic in Golang (CVE-2022-28327)

Summary Golang is used by IBM Storage Ceph as part of RGW and in assorted other locations. CVE-2022-28327 Vulnerability Details CVEID: CVE-2022-28327 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by improper input validaiton by the generic P-256 feature in crypto/elliptic. B...

Security Bulletin: IBM Storage Ceph is vulnerable to a denial of service vulnerablity in Golang Go

Summary Golang Go is used by IBM Storage Ceph as part of RGW and in assorted other locations. CVE-2022-41721, CVE-2022-27664, CVE-2022-30633, CVE-2022-28131. Vulnerability Details CVEID: CVE-2022-41721 DESCRIPTION: Golang Go is vulnerable to HTTP request smuggling, caused by a flaw when using...

Security Bulletin: IBM Storage Ceph is vulnerable to exposure of sensitive information to an unauthorized actor in Grafana [CVE-2022-39201]

Summary Grafana is used by IBM Storage Ceph as part of the dashboard to monitor the stats for each cluster CVE-2022-39201 This bulletin identifies the steps to take to address the vulnerability in Grafana. Vulnerability Details CVEID: CVE-2022-39201 DESCRIPTION: Grafana could allow a remote...

Security Bulletin: IBM Storage Ceph is vulnerable to an incorrect authorization vulnerablity in Grafana.

Summary Grafana is used by IBM Storage Ceph as part of the dashboard to monitor the stats for each cluster. CVE-2022-31107. Vulnerability Details CVEID: CVE-2022-31107 DESCRIPTION: Grafana could allow a remote authenticated attacker to bypass security restrictions, caused by an OAuth vulnerabilit...

Security Bulletin: IBM Storage Ceph is vulnerable to authentication bypass by spoofing in Grafana (CVE-2022-35957)

Summary Grafana is used by IBM Storage Ceph as part of the dashboard to monitor the stats for each cluster. CVE-2022-35957 Vulnerability Details CVEID: CVE-2022-35957 DESCRIPTION: Grafana could allow a remote authenticated attacker to gain elevated privileges on the system. By sending a specially...