Security Bulletin: IBM Storage Ceph is vulnerable to Out-of-bounds Write in the RHEL UBI (CVE-2023-29491)

Summary RHEL UBI is used by IBM Storage Ceph as the base operating system. CVE-2023-29491 This bulletin identifies the steps to take to address the vulnerability in the RHEL UBI. Vulnerability Details CVEID:CVE-2023-29491 DESCRIPTION: ncurses is vulnerable to a denial of service, caused by a memo...

Security Bulletin: IBM Storage Ceph is vulnerable to Improper Authentication in the RHEL UBI (CVE-2023-27538)

Summary RHEL UBI is used by IBM Storage Ceph as the base operating system. CVE-2023-27538 This bulletin identifies the steps to take to address the vulnerability. Vulnerability Details CVEID: CVE-2023-27538 DESCRIPTION: cURL libcurl could allow a local attacker to bypass security restrictions,...

Security Bulletin: IBM Storage Ceph is vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in the RHEL UBI (CVE-2023-27533)

Summary RHEL UBI is used by IBM Storage Ceph as the base operating system. CVE-2023-27533 This bulletin identifies the steps to take to address the vulnerability in the RHEL UBI. Vulnerability Details CVEID: CVE-2023-27533 DESCRIPTION: cURL libcurl could allow a remote attacker to bypass security...

Security Bulletin: IBM Storage Ceph is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in the RHEL UBI (CVE-2023-32681)

Summary RHEL UBI is used by IBM Storage Ceph as the base operating system. CVE-2023-32681 This bulletin identifies the steps to take to address the vulnerability in the RHEL UBI. Vulnerability Details CVEID: CVE-2023-32681 DESCRIPTION: python-requests could allow a remote attacker to obtain...

Security Bulletin: IBM Storage Ceph is vulnerable to Improper Certificate Validation in the RHEL UBI (CVE-2023-28321)

Summary RHEL UBI is used by IBM Storage Ceph as the base operating system. CVE-2023-28321 This bulletin identifies the steps to take to address the vulnerability in the RHEL UBI. Vulnerability Details CVEID: CVE-2023-28321 DESCRIPTION: cURL libcurl could allow a remote attacker to bypass security...

Security Bulletin: IBM Storage Ceph is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Grafana (CVE-2023-1410)

Summary Grafana is used by IBM Storage Ceph as a monitoring dashboard. CVE-2023-1410 This bulletin identifies the steps to take to address the vulnerability in Grafana. Vulnerability Details CVEID: CVE-2023-1410 DESCRIPTION: Grafana is vulnerable to cross-site scripting, caused by improper...

Security Bulletin: IBM Storage Ceph is vulnerable to Improper Synchronization in Grafana (CVE-2023-2801)

Summary Grafana is used by IBM Storage Ceph as a monitoring dashboard. CVE-2023-2801 This bulletin identifies the steps to take to address the vulnerability in Grafana. Vulnerability Details CVEID: CVE-2023-2801 DESCRIPTION: Grafana is vulnerable to a denial of service, caused by a proxy race...

Security Bulletin: IBM Storage Ceph is vulnerable to Missing Authorization in Grafana (CVE-2023-2183)

Summary Grafana is used by IBM Storage Ceph as a monitoring dashboard. CVE-2023-2183 This bulletin identifies the steps to take to address the vulnerability in Grafana. Vulnerability Details CVEID: CVE-2023-2183 DESCRIPTION: Grafana could allow a remote authenticated attacker to obtain sensitive...

Security Bulletin: IBM Storage Ceph is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross Site Scripting') in Bootstrap (CVE-2018-20676)

Summary Bootstrap is used by IBM Storage Ceph as a CSS framework. CVE-2018-20676 This bulletin identifies the steps to take to address the vulnerability in Bootstrap. Vulnerability Details CVEID: CVE-2018-20676 DESCRIPTION: Bootstrap is vulnerable to cross-site scripting, caused by improper...

Security Bulletin: IBM Storage Ceph is vulnerable to Uncontrolled Resource Consumption in Grafana (CVE-2023-44487)

Summary Grafana is used by IBM Storage Ceph for visualization of metrics. CVE-2023-44487 This bulletin identifies the steps to take to address the vulnerability in Grafana. Vulnerability Details CVEID: CVE-2023-44487 DESCRIPTION: Multiple vendors are vulnerable to a denial of service, caused by a...

Security Bulletin: IBM Storage Ceph is vulnerable to Uncontrolled Resource Consumption in Ceph (CVE-2023-46159)

Summary Ceph is used by IBM Storage Ceph as storage. CVE-2023-46159 This bulletin identifies the steps to take to address the vulnerability in Ceph. Vulnerability Details CVEID: CVE-2023-46159 DESCRIPTION: IBM Storage Ceph could allow an authenticated user on the network to cause a denial of...

Security Bulletin: IBM Storage Ceph is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross Site Scripting') in Bootstrap (CVE-2018-20677)

Summary Bootstrap is used by IBM Storage Ceph as a CSS framework. CVE-2018-20677 This bulletin identifies the steps to take to address the vulnerability in Bootstrap. Vulnerability Details CVEID: CVE-2018-20677 DESCRIPTION: Bootstrap is vulnerable to cross-site scripting, caused by improper...

Security Bulletin: IBM Storage Ceph is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross Site Scripting') in Bootstrap (CVE-2018-14041)

Summary Bootstrap is used by IBM Storage Ceph as a CSS framework. CVE-2018-14041 This bulletin identifies the steps to take to address the vulnerability in Bootstrap. Vulnerability Details CVEID: CVE-2018-14041 DESCRIPTION: Bootstrap is vulnerable to cross-site scripting, caused by improper...

Security Bulletin: IBM Storage Ceph is vulnerable to Use After Free in RHEL (CVE-2022-43552 )

Summary RHEL is used by IBM Storage Ceph as the base operating system. CVE-2022-43552 This bulletin identifies the steps to take to address the vulnerability in the RHEL UBI. Vulnerability Details CVEID: CVE-2022-43552 DESCRIPTION: cURL libcurl is vulnerable to a denial of service, caused by a...

Security Bulletin: IBM Storage Ceph is vulnerable to Cross Site Scripting in Grafana (CVE-2022-39324)

Summary Grafana is used by IBM Storage Ceph as part of the dashboard to monitor the stats for each cluster. CVE-2022-39324 This bulletin identifies the steps to take to address the vulnerability in Grafana. Vulnerability Details CVEID:CVE-2022-39324 DESCRIPTION: Grafana could allow a remote...

Security Bulletin: IBM Storage Ceph is vulnerable to Prototype Pollution in Ramda [CVE-2021-42581]

Summary Ramda is used by IBM Storage Ceph as part of the dashboard and in assorted other locations. CVE-2021-42581 This bulletin identifies the steps to take to address the vulnerability in Ramda. Vulnerability Details CVEID:CVE-2021-42581 DESCRIPTION: Ramda could allow a remote attacker to execu...

Security Bulletin: IBM Storage Ceph is vulnerable to improper authentication in Crewjam/SAML [CVE-2022-41912]

Summary Crewjam/SAML is used by IBM Storage Ceph as part of RGW and in assorted other locations CVE-2022-41912 This bulletin identifies the steps to take to address the vulnerability in Crewjam/SAML. Vulnerability Details CVEID:CVE-2022-41912 DESCRIPTION: Crewjam saml could allow a remote attacke...

Security Bulletin: IBM Storage Ceph is vulnerable to Incorrect privilege assignment in Golang (CVE-2022-29526)

Summary Golang is used by IBM Storage Ceph as part of RGW and in assorted other locations. CVE-2022-29526 Vulnerability Details CVEID:CVE-2022-29526 DESCRIPTION: Golang Go could allow a remote attacker to obtain sensitive information, caused by a flaw in the Faccessat function when called with a...

Security Bulletin: IBM Storage Ceph is vulnerable to uncontrolled recursion in Golang (CVE-2022-30630)

Summary Golang is used by IBM Storage Ceph as part of RGW and in assorted other locations. CVE-2022-30630 Vulnerability Details CVEID:CVE-2022-30630 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by an uncontrolled recursion flaw in Glob in io/fs due to stack exhaustion. By...

PT-2024-41772

Name of the Vulnerable Software and Affected Versions Ceph affected versions not specified Description An issue exists in Ceph related to incorrect certificate checking when using Pybind. This flaw could allow an attacker to perform a Man In the Middle MITM attack, potentially compromising mail...