SUSE SLES12 Security Update : ceph (SUSE-SU-2020:0962-1)

This update for ceph fixes the following issues : CVE-2020-1760: Fixed XSS due to RGW GetObject header-splitting bsc1166484. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and...

Debian DLA-2171-1 : ceph security update

It was discovered that there was a header-splitting vulnerability in ceph, a distributed storage and file system. For Debian 8 'Jessie', this issue has been fixed in ceph version 0.80.7-2+deb8u4. We recommend that you upgrade your ceph packages. NOTE: Tenable Network Security has extracted the...

Security update for ceph (important)

openSUSE Security Update: Security update for ceph Announcement ID: openSUSE-SU-2020:0494-1 Rating: important References: 1166403 1166484 Cross-References: CVE-2020-1759 CVE-2020-1760 Affected Products: openSUSE Leap 15.1 An update that fixes two vulnerabilities is now available. Description: Thi...

Debian: Security Advisory (DLA-2171-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2019-10222

A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests. An unauthenticated attacker could crash the Ceph RGW server by sending valid HTTP headers and terminating the connection, resulting in a remote denial of service for Ceph RGW clients. Mitigation T...

[SECURITY] [DLA 2171-1] ceph security update

Package : ceph Version : 0.80.7-2+deb8u4 CVE ID : CVE-2020-1760 Debian Bug : 956142 It was discovered that there was a header-splitting vulnerability in ceph, a distributed storage and file system. For Debian 8 "Jessie", this issue has been fixed in ceph version 0.80.7-2+deb8u4. We recommend that...

AZL-39034 CVE-2020-11655 affecting package ceph for versions less than 18.2.1-1

SQLite through 3.31.1 allows attackers to cause a denial of service segmentation fault via a malformed window-function query because the AggInfo object's initialization is mishandled...

AZL-38947 CVE-2020-11656 affecting package ceph for versions less than 18.2.1-1

In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement...

DLA-2171-1 ceph - security update

Bulletin has no description...

SUSE-SU-2020:0962-1 Security update for ceph

This update for ceph fixes the following issues: - CVE-2020-1760: Fixed XSS due to RGW GetObject header-splitting bsc1166484...

Multiple Red Hat Products Security Feature Issue Vulnerabilities

Red Hat Ceph Storage and Red Hat OpenShift are both products of Red Hat, Inc. Red Hat Ceph Storage is a scalable, open software-defined storage platform.Red Hat OpenShift is a Platform-as-a-Service PaaS cloud computing platform that supports building, testing, deploying, and running applications....

CVE-2020-1760

A flaw was found in the Ceph Object Gateway, where it supports request sent by an anonymous user in Amazon S3. This flaw could lead to potential XSS attacks due to the lack of proper neutralization of untrusted input. Mitigation Mitigation provided by DigitalOcean: Mitigation relies on the HAProx...

SUSE SLED15 / SLES15 Security Update : ceph (SUSE-SU-2020:0930-1)

This update for ceph fixes the following issues : CVE-2020-1759: Fixed once reuse in msgr V2 secure mode bsc1166403 CVE-2020-1760: Fixed XSS due to RGW GetObject header-splitting bsc1166484. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE...

ceph14 -- multiple security issues

RedHat reports: ceph: secure mode of msgr2 breaks both confidentiality and integrity aspects for long-lived sessions. ceph: header-splitting in RGW GetObject has a possible XSS...

SUSE-SU-2020:0930-1 Security update for ceph

This update for ceph fixes the following issues: - CVE-2020-1759: Fixed once reuse in msgr V2 secure mode bsc1166403 - CVE-2020-1760: Fixed XSS due to RGW GetObject header-splitting bsc1166484...

PT-2020-15040

Name of the Vulnerable Software and Affected Versions Red Hat Ceph Storage version 4 Red Hat Openshift Container Storage version 4.2 Description A nonce reuse issue was discovered in the secure mode of the messenger v2 protocol. This allows an attacker to forge auth tags and potentially manipulat...

PT-2020-6261

Name of the Vulnerable Software and Affected Versions Ceph Object Gateway affected versions not specified Description The issue is related to the Ceph Object Gateway, which supports requests from anonymous users in Amazon S3. This could lead to potential XSS attacks due to the lack of proper...

EulerOS 2.0 SP8 : ceph (EulerOS-SA-2020-1285)

According to the version of the ceph packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - It was found Ceph versions before 13.2.4 that authenticated ceph users with read only permissions could steal dm-crypt encryption keys used in ceph...

Huawei EulerOS: Security Advisory for ceph (EulerOS-SA-2020-1285)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 18.04 LTS : Ceph vulnerability (USN-4304-1)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4304-1 advisory. Or Friedman discovered that Ceph incorrectly handled disconnects. A remote authenticated attacker could possibly use this issue to cause Ceph to consume resources...