CVE-2020-10753

CVE-2020-10753 affects Red Hat Ceph Storage RadosGW (Ceph Object Gateway). A newline in a CORS ExposeHeader tag in the CORS configuration can inject HTTP headers into responses, enabling header injection during CORS requests. The issue is reported for Ceph RGW in versions 3.x and 4.x (with relate...

CVE-2020-1760

CVE-2020-1760 affects Ceph RGW (Ceph Object Gateway): an anonymous S3 request can trigger cross-site scripting due to insufficient input neutralization. The issue is rooted in how untrusted input is handled in the RGW/ExposeHeader scenarios, enabling potential XSS when a path to a publicly readab...

CVE-2021-20288

Ceph CVE-2021-20288 is an authentication flaw in Ceph before certain fixed releases. The root cause is that CEPHX_GET_AUTH_SESSION_KEY handling does not sanitize other_keys, allowing reuse of old keys when a global_id is requested, enabling a user to leverage a global_id previously associated wit...

CVE-2020-1759

CVE-2020-1759 affects Red Hat Ceph Storage 4 and Red Hat OpenShift Container Storage 4.2, where the secure mode of the messenger v2 protocol (msgr2) allows nonce reuse. This enables forging authentication tags and can lead to confidentiality and integrity problems in sessions when a nonce is reus...

CVE-2020-1699

CVE-2020-1699 affects Ceph’s dashboard in upstream Ceph v14.2.5, v14.2.6, and v15.0.0, enabling information disclosure via a path traversal flaw. It is fixed in v14.2.7 and v15.1.0. The vulnerability is exploitable by an unauthenticated attacker and could reveal host-machine information running t...

CVE-2022-0670

CVE-2022-0670 affects Ceph/Manailla integration for OpenStack CephFS shares via the volumes plugin in Ceph Manager. The root cause is a bug in the volumes plugin that lets the share owner read/write any Manila share or the entire filesystem, compromising confidentiality and integrity. Remediation...

CVE-2020-12059

CVE-2020-12059 affects Ceph RGW; up to Ceph 13.2.9, a POST request with an invalid tagging XML can crash the RGW process by triggering a NULL pointer exception, causing a Denial of Service. Debian and Red Hat advisories confirm fixes: Debian 10 (buster) patched via ceph 12.2.11+dfsg1-2.1+deb10u1,...

CVE-2020-10736

CVE-2020-10736 affects Ceph 15.2.0 up to, but not including, 15.2.2. The root cause is an authorization bypass in ceph-mon and ceph-mgr that allows an authenticated client to access unauthorized resources and modify configuration, potentially enabling further attacks. The documented impact is hig...