Red Hat Security Advisory

RHSA-2019:2541

Red Hat Ceph Storage 3.3 security, bug fix, and enhancement update

Released 2019-08-21 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Ceph Storage 3 for Ubuntu

Fixes 3 records

TI-2018-12099 CVE-2018-16889 · GHSA-2xfm-mgc4-j8fx

Sensitive information in log files in ceph

LOW 34

Ceph does not properly sanitize encryption keys in debug logging for v4 auth.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.00536 Published 2019-01-28 Fixed CWE-532

TI-2018-12056 CVE-2018-16846 · GHSA-77fq-6x6c-cq7q

Resource allocation without limits in [UNKNOWN] ceph

LOW 33

It was found in Ceph versions before 13.2.4 that authenticated ceph RGW users can cause a denial of service against OMAPs holding bucket indices.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.02136 Published 2019-01-15 Partial fix CWE-770

TI-2018-10525 CVE-2018-14662 · GHSA-w2x2-w9fr-cf6g

Improper authorization in [UNKNOWN] ceph

LOW 26

It was found Ceph versions before 13.2.4 that authenticated ceph users with read only permissions could steal dm-crypt encryption keys used in ceph disk encryption.

CVSS 3.1MEDIUM 5.7 Adjacent network Low privileges No interaction EPSS 0.0049 Published 2019-01-15 Partial fix CWE-285