2993 matches found
Red Hat Ceph Storage ceph-isci-cli package remote command injection vulnerability
Red Hat Ceph Storage is a suite of scalable, open software-defined storage platforms from Red Hat, Inc. ceph-isci-cli is one of the command-line programs. A security vulnerability exists in the ceph-isci-cli package in Red Hat Ceph Storage versions 2 and 3. An attacker could use this vulnerabilit...
CVE-2018-14649
It was found that ceph-isci-cli package as shipped by Red Hat Ceph Storage 2 and 3 is using python-werkzeug in debug shell mode. This is done by setting debug=True in file /usr/bin/rbd-target-api provided by ceph-isci-cli package. This allows unauthenticated attackers to access this debug shell a...
CVE-2018-14649
It was found that ceph-isci-cli package as shipped by Red Hat Ceph Storage 2 and 3 is using python-werkzeug in debug shell mode. This is done by setting debug=True in file /usr/bin/rbd-target-api provided by ceph-isci-cli package. This allows unauthenticated attackers to access this debug shell a...
Design/Logic Flaw
It was found that ceph-isci-cli package as shipped by Red Hat Ceph Storage 2 and 3 is using python-werkzeug in debug shell mode. This is done by setting debug=True in file /usr/bin/rbd-target-api provided by ceph-isci-cli package. This allows unauthenticated attackers to access this debug shell a...
CVE-2018-14649
It was found that ceph-isci-cli package as shipped by Red Hat Ceph Storage 2 and 3 is using python-werkzeug in debug shell mode. This is done by setting debug=True in file /usr/bin/rbd-target-api provided by ceph-isci-cli package. This allows unauthenticated attackers to access this debug shell a...
CVE-2018-14649
Summary of CVE-2018-14649 : The ceph-isci-cli package in Red Hat Ceph Storage versions 2 and 3 runs the rbd-target-api Python app with Werkzeug in debug mode, exposing an unauthenticated debug shell. This allows remote command execution with the privileges of the running process (often root) via ...
PT-2018-12640 · Pallets Projects +1 · Python-Werkzeug +1
Name of the Vulnerable Software and Affected Versions: Red Hat Ceph Storage versions 2 and 3 Description: The issue allows unauthenticated attackers to access a debug shell and escalate privileges. This is due to the ceph-isci-cli package using python-werkzeug in debug shell mode, enabled by...
RHEL 7 : ceph-iscsi-cli (RHSA-2018:2838)
An update for ceph-iscsi-cli is now available for Red Hat Ceph Storage 3.1 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
RHEL 7 : ceph-iscsi-cli (RHSA-2018:2837)
The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2018:2837 advisory. ceph-iscsi-cli provides a CLI interface similar to the targetcli tool used to interact with the kernel LIO subsystem. Security Fixes: It was found th...
ceph-iscsi-cli: rbd-target-api service runs in debug mode allowing for remote command execution
It was found that rbd-target-api service provided by ceph-iscsi-cli was running in debug mode. An unauthenticated attacker could use this to remotely execute arbitrary code and escalate privileges...
Critical: Red Hat Security Advisory: ceph-iscsi-cli security update
An update for ceph-iscsi-cli is now available for Red Hat Ceph Storage 2.5 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
ceph-iscsi-cli: rbd-target-api service runs in debug mode allowing for remote command execution
It was found that rbd-target-api service provided by ceph-iscsi-cli was running in debug mode. An unauthenticated attacker could use this to remotely execute arbitrary code and escalate privileges...
Critical: Red Hat Security Advisory: ceph-iscsi-cli security update
An update for ceph-iscsi-cli is now available for Red Hat Ceph Storage 3.1 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2018:2776-1)
The SUSE Linux Enterprise 12 SP3 kernel was updated to 4.4.155 to receive various security and bugfixes. The following security bugs were fixed : CVE-2018-13093: Prevent NULL pointer dereference and panic in lookupslow on a NULL inode-iops pointer when doing pathwalks on a corrupted xfs image. Th...
RHEL 7 : Red Hat Ceph Storage 1.3.3 (RHSA-2016:1972)
Red Hat Ceph Storage 1.3.3 that fixes one security issue, multiple bugs, and adds various enhancements is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score,...
RHEL 7 : ceph (RHSA-2016:1384)
An updated ceph package that fixes one security issue is now available for Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity...
openSUSE: Security Advisory for ceph (openSUSE-SU-2018:2479-1)
The remote host is missing an update for the Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
SUSE SLED12 / SLES12 Security Update : ceph (SUSE-SU-2018:2478-1)
This update for ceph fixes the following issues : - Update to version 12.2.7-420-gc0ef85b854 : - https://ceph.com/releases/12-2-7-luminous-released/ - luminous: osd: eternal stuck PG in 'unfoundrecovery' bsc1094932 - bluestore: db.slow used when db is not full bsc1092874 - CVE-2018-10861: Ensure...
Security update for ceph (important)
This update for ceph fixes the following issues: Security issues fixed: - CVE-2018-7262: rgw: malformed http headers can crash rgw bsc1081379. - CVE-2017-16818: User reachable asserts allow for DoS bsc1063014. Bug fixes: - bsc1061461: OSDs keep generating coredumps after adding new OSD node to...