Red Hat Security Advisory: Red Hat Ceph Storage 2.5 security, enhancement, and bug fix update
An update for ceph is now available for Red Hat Ceph Storage 2.5 for Ubuntu 16.04. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
beschreibt (3)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2018-1129US | medium6.5 | — | ||
A flaw was found in the way signature calculation was handled by cephx authentication protocol. An attacker having access to ceph cluster network who is able to alter the message p… | ||||
| CVE-2018-1128US | high7.5OT erhöht | — | ||
It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to ceph cluster network who is… | ||||
| CVE-2018-10861US | high8.1 | — | ||
A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph storage pools and corrupt snapshot images… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://access.redhat.com/documentation/en-us/red_hat_ceph_storage/2.5/html/release_notes/bug_fixesexternal
- https://access.redhat.com/errata/RHSA-2018:2274self
- https://access.redhat.com/security/updates/classification/#moderateexternal
- 1575866external
- 1576057external
- 1593308external
- https://rhcs.download.redhat.com/ubuntuexternal
- Canonical URLself
Behebungen (4)
- BehobenRed Hat Ceph Storage 2 for Ubuntu
The References section of this erratum contains a download link. You must log in to download the update. Refer to the Red Hat Ceph Storage 2 Installation Guide for more information: https://access.redhat.com/documentation/en-us/red_hat_ceph_storage/2/html-single/installation_guide_for_ubuntu/#enabling_the_red_hat_ceph_storage_repositories
https://access.redhat.com/errata/RHSA-2018:2274 - BehobenRed Hat Ceph Storage 2 for Ubuntu
The References section of this erratum contains a download link. You must log in to download the update. Refer to the Red Hat Ceph Storage 2 Installation Guide for more information: https://access.redhat.com/documentation/en-us/red_hat_ceph_storage/2/html-single/installation_guide_for_ubuntu/#enabling_the_red_hat_ceph_storage_repositories
https://access.redhat.com/errata/RHSA-2018:2274 - BehobenRed Hat Ceph Storage 2 for Ubuntu
The References section of this erratum contains a download link. You must log in to download the update. Refer to the Red Hat Ceph Storage 2 Installation Guide for more information: https://access.redhat.com/documentation/en-us/red_hat_ceph_storage/2/html-single/installation_guide_for_ubuntu/#enabling_the_red_hat_ceph_storage_repositories
https://access.redhat.com/errata/RHSA-2018:2274 - WorkaroundRed Hat Ceph Storage 2 for Ubuntu
Use mon_allow_pool_delete = false in ceph.conf to disable deletion of pools ~]$ for p in `rados lspools` do ceph osd pool set $p nodelete true done caveat: This mitigation does not protect against attacker from corrupting snapshot images
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan