Red Hat Security AdvisoryRHSA-2023:5693
Red Hat Ceph Storage 6.1 security, enhancement, and bug fix update
Released 2023-10-12 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Ceph Storage 6.1 Tools ceph-2:17.2.6-148.el9cp, ceph-base-2:17.2.6-148.el9cp, ceph-common-2:17.2.6-148.el9cp +25
Fixes 6 records
Priority CRITICAL 90KEV
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.99999 · Published 2023-10-10 · Partial fix · 1.28.0, 0.17.0 +9 CWE-400
Priority MEDIUM 48
IBM Spectrum Fusion HCI 2.5.2 through 2.7.2 could allow an attacker to perform unauthorized actions in RGW for Ceph due to improper bucket access.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03063 · Published 2024-05-13 · Partial fix CWE-1220
Priority LOW 34
In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.03984 · Published 2019-01-09 · Partial fix · 3.4.0 CWE-79
Priority LOW 34
In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.03835 · Published 2019-01-09 · Partial fix · 3.4.0 CWE-79
Priority LOW 34
In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.04312 · Published 2018-07-13 · Partial fix · 4.1.2, 8.7.23 +1 CWE-79
Priority LOW 30
IBM Storage Ceph 5.3z1, 5.3z5, and 6.1z1 could allow an authenticated user on the network to cause a denial of service from RGW.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00812 · Published 2024-02-02 · Fixed CWE-20
THREATIST.IORead the docs