Red Hat Security Advisory

RHSA-2020:5325

Red Hat Ceph Storage 4.1 security and bug fix update

Released 2020-12-02 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Ceph Storage 4.1 MON ceph-2:14.2.8-115.el7cp, ceph-2:14.2.8-115.el8cp, ceph-base-2:14.2.8-115.el7cp +47
Red Hat Ceph Storage 4.1 OSD ceph-2:14.2.8-115.el7cp, ceph-2:14.2.8-115.el8cp, ceph-base-2:14.2.8-115.el7cp +39
Red Hat Ceph Storage 4.1 Tools ceph-2:14.2.8-115.el7cp, ceph-2:14.2.8-115.el8cp, ceph-base-2:14.2.8-115.el7cp +47

Fixes 1 record

TI-2020-15677 CVE-2020-25660 · GHSA-457q-vj84-7r8r

Authentication bypass by capture-replay in ceph

MEDIUM 40

A flaw was found in the Cephx authentication protocol in versions before 15.2.6 and before 14.2.14, where it does not verify Ceph clients correctly and is then vulnerable to replay attacks in Nautilus.

CVSS 3.1HIGH 8.8 Adjacent network No auth No interaction EPSS 0.01034 Published 2020-11-23 Partial fix CWE-294