Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 544
Alerts This Week
Warning Icon 1 544

SUSE MicroOS: 2021:1834-1 Important: Ceph Cookie Injection Issue

suse
Calendar Grey June 2, 2021
Scroller Suse
A significant announcement from SUSE tackles essential vulnerabilities in ceph, aiming to improve both security measures and overall system reliability.
An update that fixes three vulnerabilities is now available

Summary

This update for ceph fixes the following issues: - Update to 15.2.12-83-g528da226523: - (CVE-2021-3509) fix cookie injection issue (bsc#1186021) - (CVE-2021-3531) RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (bsc#1186020) - (CVE-2021-3524) sanitize \r in s3 CORSConfiguration’s ExposeHeader (bsc#1185619) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE MicroOS 5.0: zypper in -t patch SUSE-SUSE-MicroOS-5.0-2021-1834=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2021-1834=1 - SUSE Linux Enterprise Module for Basesystem 15-SP2:

Topics%20covered

Topics Covered

security advisory patch important SUSE Enterprise Storage cookie injection ceph SUSE MicroOS

References

#1185619 #1186020 #1186021

Cross- CVE-2021-3509 CVE-2021-3524 CVE-2021-3531

CVSS scores:

CVE-2021-3509 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2021-3524 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CVE-2021-3524 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CVE-2021-3531 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CVE-2021-3531 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products:

SUSE MicroOS 5.0

SUSE Linux Enterprise Module for Basesystem 15-SP3

SUSE Linux Enterprise Module for Basesystem 15-SP2

SUSE Enterprise Storage 7

https://www.suse.com/security/cve/CVE-2021-3509.html

https://www.suse.com/security/cve/CVE-2021-3524.html

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2021:1834-1
Rating: important

Topics%20covered

Topics Covered

security advisory patch important SUSE Enterprise Storage cookie injection ceph SUSE MicroOS

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.