Astra Linux – Vulnerability in Ceph

A flaw was discovered in Red Hat Ceph Storage 4, within the Dashboard component. In response to CVE-2020-27839, the JWT token was moved from localStorage to an httpOnly cookie. However, token cookies are used in the body of the HTTP response for documentation purposes, which again exposes them to...

SUSE CVE-2020-27839

A flaw was found in ceph-dashboard. The JSON Web Token JWT used for user authentication is stored by the frontend application in the browser's localStorage which is potentially vulnerable to attackers via XSS attacks. The highest threat from this vulnerability is to data confidentiality and...

openSUSE 15 Security Update : ceph (openSUSE-SU-2021:1834-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1834-1 advisory. - A flaw was found in Red Hat Ceph Storage 4, in the Dashboard component. In response to CVE-2020-27839, the JWT token was moved from...

ceph-dashboard: Cross-site scripting via token Cookie

A flaw was found in the Red Hat Ceph Storage Dashboard. In response to CVE-2020-27839, the JWT token was moved from localStorage to an httpOnly cookie. However, token cookies are used in the body of the HTTP response for the documentation, which again makes it available to XSS. The greatest threa...

Important: Red Hat Security Advisory: Red Hat Ceph Storage 4.2 Security and Bug Fix Update

An update for ceph, ceph-ansible, ceph-iscsi, python-waitress, and tcmu-runner is now available for Red Hat Ceph Storage 4.2. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

SUSE: Security Advisory (SUSE-SU-2021:1108-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2021:1473-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-3509

Affects Red Hat Ceph Storage 4 dashboard (ceph-dashboard). The root cause is storage of the JWT for user authentication in the browser (localStorage), which exposes tokens to XSS risks. This is described in connected advisories for Ceph-derived distributions (Astral/Linux security bulletins and M...

CVE-2020-27839

A flaw was found in ceph-dashboard. The JSON Web Token JWT used for user authentication is stored by the frontend application in the browser’s localStorage which is potentially vulnerable to attackers via XSS attacks. The highest threat from this vulnerability is to data confidentiality and...

openSUSE: Security Advisory for ceph (openSUSE-SU-2021:0544-1)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

openSUSE Security Update : ceph (openSUSE-2021-544)

This update for ceph fixes the following issues : - ceph was updated to to 15.2.9 - cephadm: fix 'inspect' and 'pull' bsc1182766 - CVE-2020-27839: mgr/dashboard: Use secure cookies to store JWT Token bsc1179997 - CVE-2020-25678: Do not add sensitive information in Ceph log files bsc1178905 -...

Security update for ceph (moderate)

openSUSE Security Update: Security update for ceph Announcement ID: openSUSE-SU-2021:0544-1 Rating: moderate References: 1172926 1176390 1176489 1176679 1176828 1177360 1177857 1178837 1178860 1178905 1178932 1179569 1179997 1182766 Cross-References: CVE-2020-25678 CVE-2020-27839 CVSS scores:...

SUSE SLED15 / SLES15 Security Update : ceph (SUSE-SU-2021:1108-1)

This update for ceph fixes the following issues : ceph was updated to to 15.2.9 cephadm: fix 'inspect' and 'pull' bsc1182766 CVE-2020-27839: mgr/dashboard: Use secure cookies to store JWT Token bsc1179997 CVE-2020-25678: Do not add sensitive information in Ceph log files bsc1178905...

Updated ceph packages fix security vulnerabilities

A flaw was found in Ceph where Ceph stores mgr module passwords in clear text. This issue can be found by searching the mgr logs for Grafana and dashboard with passwords visible. The highest threat from this vulnerability is to confidentiality CVE-2020-25678. A flaw was found in ceph-dashboard. T...

Fedora: Security Advisory for ceph (FEDORA-2021-93ff9e9103)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...