Red Hat Security Advisory: Red Hat Ceph Storage 2.5 security, enhancement, and bug fix update
An update for ceph is now available for Red Hat Ceph Storage 2.5 for Ubuntu 16.04. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
describes (3)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2018-1129US | medium6.5 | — | ||
A flaw was found in the way signature calculation was handled by cephx authentication protocol. An attacker having access to ceph cluster network who is able to alter the message p… | ||||
| CVE-2018-1128US | high7.5OT elevated | — | ||
It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to ceph cluster network who is… | ||||
| CVE-2018-10861US | high8.1 | — | ||
A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph storage pools and corrupt snapshot images… | ||||
references
External citations — patches, advisories, analysis.
- https://access.redhat.com/documentation/en-us/red_hat_ceph_storage/2.5/html/release_notes/bug_fixesexternal
- https://access.redhat.com/errata/RHSA-2018:2274self
- https://access.redhat.com/security/updates/classification/#moderateexternal
- 1575866external
- 1576057external
- 1593308external
- https://rhcs.download.redhat.com/ubuntuexternal
- Canonical URLself
remediations (4)
- FixedRed Hat Ceph Storage 2 for Ubuntu
The References section of this erratum contains a download link. You must log in to download the update. Refer to the Red Hat Ceph Storage 2 Installation Guide for more information: https://access.redhat.com/documentation/en-us/red_hat_ceph_storage/2/html-single/installation_guide_for_ubuntu/#enabling_the_red_hat_ceph_storage_repositories
https://access.redhat.com/errata/RHSA-2018:2274 - FixedRed Hat Ceph Storage 2 for Ubuntu
The References section of this erratum contains a download link. You must log in to download the update. Refer to the Red Hat Ceph Storage 2 Installation Guide for more information: https://access.redhat.com/documentation/en-us/red_hat_ceph_storage/2/html-single/installation_guide_for_ubuntu/#enabling_the_red_hat_ceph_storage_repositories
https://access.redhat.com/errata/RHSA-2018:2274 - FixedRed Hat Ceph Storage 2 for Ubuntu
The References section of this erratum contains a download link. You must log in to download the update. Refer to the Red Hat Ceph Storage 2 Installation Guide for more information: https://access.redhat.com/documentation/en-us/red_hat_ceph_storage/2/html-single/installation_guide_for_ubuntu/#enabling_the_red_hat_ceph_storage_repositories
https://access.redhat.com/errata/RHSA-2018:2274 - WorkaroundRed Hat Ceph Storage 2 for Ubuntu
Use mon_allow_pool_delete = false in ceph.conf to disable deletion of pools ~]$ for p in `rados lspools` do ceph osd pool set $p nodelete true done caveat: This mitigation does not protect against attacker from corrupting snapshot images
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan