Red Hat Security AdvisoryRHSA-2021:0081
Red Hat Ceph Storage 4.2 Security and Bug Fix update
Released 2021-01-12 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Ceph Storage 4.2 MON ceph-2:14.2.11-95.el7cp, ceph-2:14.2.11-95.el8cp, ceph-base-2:14.2.11-95.el7cp +47
- Red Hat Ceph Storage 4.2 OSD ceph-2:14.2.11-95.el7cp, ceph-2:14.2.11-95.el8cp, ceph-base-2:14.2.11-95.el7cp +39
- Red Hat Ceph Storage 4.2 Tools ceph-2:14.2.11-95.el7cp, ceph-2:14.2.11-95.el8cp, ceph-ansible-4.0.41-1.el7cp +47
Fixes 3 records
Priority MEDIUM 40
A flaw was found in the Cephx authentication protocol in versions before 15.2.6 and before 14.2.14, where it does not verify Ceph clients correctly and is then vulnerable to replay attacks in Nautilus.
CVSS 3.1HIGH 8.8· Adjacent network · No auth · No interaction · EPSS 0.01034 · Published 2020-11-23 · Partial fix CWE-294
Priority LOW 31
User credentials can be manipulated and stolen by Native CephFS consumers of OpenStack Manila, resulting in potential privilege escalation.
CVSS 3.1HIGH 7.1· Local · Low privileges · No interaction · EPSS 0.00295 · Published 2020-12-18 · Partial fix CWE-522
Priority LOW 24
A flaw was found in Ceph-ansible v4.0.41 where it creates an /etc/ceph/iscsi-gateway.conf with insecure default permissions.
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00213 · Published 2020-12-08 · Partial fix CWE-312
