Red Hat Ceph Storage security vulnerabilities

Red Hat Ceph Storage is a suite of scalable, open software-defined storage platforms from Red Hat USA. github.com/containers/storage A security vulnerability exists that can be exploited by an attacker to create a malicious image that can lead to a denial of service DoS...

Ceph rgw::asio::ClientIO DoS

The vulnerability of the rgw::asio::ClientIO method in the rgw/rgwasiofrontend.cc of the Ceph storage system is related to a resource management mechanism error. Exploiting this vulnerability could allow an attacker to cause service failures...

AZL-38836 CVE-2021-28361 affecting package ceph for versions less than 18.2.2-1

An issue was discovered in Storage Performance Development Kit SPDK before 20.01.01. If a PDU is sent to the iSCSI target with a zero length but data is expected, the iSCSI target can crash with a NULL pointer dereference...

AZL-39466 CVE-2021-28361 affecting package ceph for versions less than 16.2.10-3

An issue was discovered in Storage Performance Development Kit SPDK before 20.01.01. If a PDU is sent to the iSCSI target with a zero length but data is expected, the iSCSI target can crash with a NULL pointer dereference...

Updated ceph packages fix security vulnerabilities

A flaw was found in Ceph where Ceph stores mgr module passwords in clear text. This issue can be found by searching the mgr logs for Grafana and dashboard with passwords visible. The highest threat from this vulnerability is to confidentiality CVE-2020-25678. A flaw was found in ceph-dashboard. T...

MGASA-2021-0126 Updated ceph packages fix security vulnerabilities

A flaw was found in Ceph where Ceph stores mgr module passwords in clear text. This issue can be found by searching the mgr logs for Grafana and dashboard with passwords visible. The highest threat from this vulnerability is to confidentiality CVE-2020-25678. A flaw was found in ceph-dashboard. T...

Cross-site Scripting (XSS)

ceph dashboard is vulnerable to cross-site scripting XSS attacks. The JSON Web Token JWT used for user authentication is stored by the frontend application in the browser’s localStorage which is potentially vulnerable to attackers via XSS attacks...

Information Disclosure

ceph is vulnerable to information disclosure. The vulnerability exists due to the password stored in mgr logs for gradana and dashboard...

Fedora 33 : 2:ceph (2021-93ff9e9103)

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-93ff9e9103 advisory. - A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in clear text. This can be found by searching the mgr...

Red Hat Ceph security vulnerabilities

Red Hat Ceph is a Linux petabyte-level distributed file system from Red Hat. The main goal of the system is to be designed as a distributed file system without a single point of failure based on POSIX Portable Operating System Interface, enabling fault-tolerant and seamless replication of data...

Fedora: Security Advisory for ceph (FEDORA-2021-93ff9e9103)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 33 Update: ceph-15.2.9-1.fc33

Ceph is a massively scalable, open-source, distributed storage system that runs on commodity hardware and delivers object, block and file system storage...

AZL-38944 CVE-2021-24032 affecting package ceph for versions less than 18.2.2-5

Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output files with default permissions and restricted those permissions immediately afterwards. Output files could therefore momentarily be readable or writable to...

AZL-39352 CVE-2021-24032 affecting package ceph for versions less than 16.2.10-3

Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output files with default permissions and restricted those permissions immediately afterwards. Output files could therefore momentarily be readable or writable to...

Security Bulletin: IBM Cloud Private is vulnerable to Kubernetes vulnerabilities (CVE-2020-8566, CVE-2020-8565, CVE-2020-8563, CVE-2020-8564)

Summary IBM Cloud Private is vulnerable to Kubernetes vulnerabilities Vulnerability Details CVEID: CVE-2020-8566 DESCRIPTION: Kubernetes could allow a local authenticated attacker to obtain sensitive information, caused by a flaw when Ceph RBD volumes are supported and kube-controller-manager is...

PT-2021-11426

Name of the Vulnerable Software and Affected Versions: ceph-dashboard affected versions not specified Description: A flaw was found in the way the JSON Web Token JWT used for user authentication is stored. The token is stored by the frontend application in the browser's localStorage, making it...

kubernetes: Ceph RBD adminSecrets exposed in logs when loglevel >= 4

A flaw was found in kubernetes. If the logging level is to at least 4, and Ceph RBD is configured as a storage provisioner, then Ceph RBD admin secrets can be written to logs. This occurs in kube-controller-manager's logs during provisioning of Ceph RBD persistent claims...

OESA-2021-1009 ceph security update

Ceph is a massively scalable, open-source, distributed storage system that runs on commodity hardware and delivers object, block and file system storage.\r\n\r\n Security Fixes:\r\n\r\n An issue was discovered in Ceph through 13.2.9. A POST request with an invalid tagging XML can crash the RGW...

kernel security, bug fix, and enhancement update

3.10.0-1160.15.2.OL7 - Oracle Linux certificates Ilya Okomin - Oracle Linux RHCK Module Signing Key was compiled into kernel [email protected] - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and shim-x64 = 15-2.0.3 3.10.0-1160.15.2 - fs nfs: Fix...

Huawei EulerOS: Security Advisory for ceph (EulerOS-SA-2021-1136)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...