Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 428
Alerts This Week
Warning Icon 1 428

RedHat: RHSA-2019-2541-01 Moderate: Ceph Storage Security Update

red hat
Calendar Grey August 21, 2019
Dist Redhat Esm H88
The security advisory for Red Hat Ceph Storage 3.3 highlights vulnerabilities affecting system stability and data integrity, with critical patches and enhancements.
An update is now available for Red Hat Ceph Storage 3.3 on Ubuntu 16.04

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

ingle/installation_guide_for_ubuntu/index#upgrading-the-storage-cluster

Summary

Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable version of the Ceph storage system with a Ceph management platform, deployment utilities, and support services.
Security Fix(es):
* ceph: ListBucket max-keys has no defined limit in the RGW codebase (CVE-2018-16846)
* ceph: debug logging for v4 auth does not sanitize encryption keys (CVE-2018-16889)
* ceph: authenticated user with read only permissions can steal dm-crypt / LUKS key (CVE-2018-14662)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es) and Enhancement(s):
For detailed information on changes in this release, see the Red Hat Ceph Storage 3.3 Release Notes available at:
/release_notes/index

Topics%20covered

Topics Covered

security advisory moderate security issue bug fix Ubuntu Red Hat Ceph Storage storage platform

References

https://access.redhat.com/security/cve/CVE-2018-14662 https://access.redhat.com/security/cve/CVE-2018-16846 https://access.redhat.com/security/cve/CVE-2018-16889 https://access.redhat.com/security/updates/classification#moderate https://docs.redhat.com/en/documentation/red_hat_ceph_storage/3.3/html/release_notes/index

Package List


Advisory ID: RHSA-2019:2541-01
Product: Red Hat Ceph Storage
Advisory URL: https://access.redhat.com/errata/RHSA-2019:2541
Issue date: 2019-08-21

Topic

An update is now available for Red Hat Ceph Storage 3.3 on Ubuntu 16.04.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory moderate security issue bug fix Ubuntu Red Hat Ceph Storage storage platform

Relevant Releases Architectures

Bugs Fixed

1637327 - CVE-2018-14662 ceph: authenticated user with read only permissions can steal dm-crypt / LUKS key

1644461 - CVE-2018-16846 ceph: ListBucket max-keys has no defined limit in the RGW codebase

1665334 - CVE-2018-16889 ceph: debug logging for v4 auth does not sanitize encryption keys

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.