Mageia 2021-0126: ceph security update
Summary
A flaw was found in Ceph where Ceph stores mgr module passwords in clear text.
This issue can be found by searching the mgr logs for Grafana and dashboard
with passwords visible. The highest threat from this vulnerability is to
confidentiality (CVE-2020-25678).
A flaw was found in ceph-dashboard. The JSON Web Token (JWT) used for user
authentication is stored by the frontend application in the browser’s
localStorage which is potentially vulnerable to attackers via XSS attacks. The
highest threat from this vulnerability is to data confidentiality and
integrity (CVE-2020-27839).
References
- https://bugs.mageia.org/show_bug.cgi?id=28538
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/OQTBKVXVYP7GPQNZ5VASOIJHMLK7727M/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25678
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27839
Resolution
MGASA-2021-0126 - Updated ceph packages fix security vulnerabilities
SRPMS
- 8/core/ceph-15.2.9-1.mga8