2994 matches found
Moderate: Red Hat Security Advisory: Red Hat Ceph Storage 3.3 security and bug fix update
Updated packages that fixes one security issue and multiple bugs are now available for Red Hat Ceph Storage 3.3. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, i...
Moderate: Red Hat Security Advisory: Red Hat Ceph Storage 3.3 Security update
An update is now available for Red Hat Ceph Storage 3.3 on Ubuntu 16.04. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...
ceph: radosgw: HTTP header injection via CORS ExposeHeader tag
A flaw was found in the Red Hat Ceph Storage RadosGW Ceph Object Gateway. The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the...
RHEL 7 : Red Hat Ceph Storage 3.3 (RHSA-2020:3504)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:3504 advisory. Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable version of the Ceph storage system with a...
AZL-40962 CVE-2020-24371 affecting package ceph for versions less than 18.2.2-3
lgc.c in Lua 5.4.0 mishandles the interaction between barriers and the sweep phase, leading to a memory access violation involving collectgarbage...
Information Disclosure
ceph is vulnerable to information disclosure. A flaw was found in the way the Ceph RGW Beast front-end handles unexpected disconnects. An authenticated attacker can abuse this flaw by making multiple disconnect attempts resulting in a permanent leak of a socket connection by radosgw. This flaw...
Nonce Reuse
ceph is vulnerable to nonce reuse in the secure mode of the messenger v2 protocol. It allows an attacker to forge auth tags and potentially manipulate the data by leveraging the reuse of a nonce in a session. Messages encrypted using a reused nonce value are susceptible to serious confidentiality...
Directory Traversal
ceph is vulnerable to directory traversal. An unauthenticated attacker is able to exploit the vulnerability to cause information disclosure on the host machine running the Ceph dashboard...
Cross-Site Scripting (XSS)
ceph is vulnerable to cross-site scripting XSS. Header-splitting in RGW GetObject allows an attacker to inject and execute arbitrary Javascript in a user's browser...
HTTP Header Injection
ceph is vulnerable to HTTP header injection. The vulnerability exists in radosgw through the CORS ExposeHeader tag...
ceph: header-splitting in RGW GetObject has a possible XSS
A flaw was found in the Ceph Object Gateway, where it supports request sent by an anonymous user in Amazon S3. This flaw could lead to potential XSS attacks due to the lack of proper neutralization of untrusted input...
Moderate: Red Hat Security Advisory: Red Hat Ceph Storage 4.1 security and bug fix update
An update is now available for Red Hat Ceph Storage 4.1. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in...
ceph: radosgw: HTTP header injection via CORS ExposeHeader tag
A flaw was found in the Red Hat Ceph Storage RadosGW Ceph Object Gateway. The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the...
RHEL 7 / 8 : Red Hat Ceph Storage 4.1 (RHSA-2020:3003)
The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3003 advisory. Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable version of the Ceph storage...
openSUSE Security Update : ceph (openSUSE-2020-898)
This update for ceph fixes the following issues : - CVE-2020-10753: Fixed an HTTP header injection via CORS ExposeHeader tag bsc1171921. This update was imported from the SUSE:SLE-15-SP1:Update update project. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...
The vulnerability of the Ceph storage system, related to the failure to handle CRLF sequences in HTTP headers, allows attackers to inject arbitrary HTTP headers.
The vulnerability of the Ceph storage system is related to the failure to handle CRLF sequences in HTTP headers. Exploiting this vulnerability allows a malicious actor to inject arbitrary HTTP headers, such as Set-Cookie, in order to install arbitrary cookie files...
SUSE SLES12 Security Update : ceph (SUSE-SU-2020:1748-1)
This is a version update for ceph to version 12.2.13 : Security issue fixed : CVE-2020-10753: Fixed an HTTP header injection via CORS ExposeHeader tag bsc1171921. Notable changes in this update for ceph : - mgr: telemetry: backported and now available on SES5.5. Please consider enabling via 'ceph...
SUSE SLED15 / SLES15 Security Update : ceph (SUSE-SU-2020:1747-1)
This update for ceph fixes the following issues : CVE-2020-10753: Fixed an HTTP header injection via CORS ExposeHeader tag bsc1171921. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically...
Fedora: Security Advisory for ceph (FEDORA-2020-c9bff9688e)
The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
