ALT-BU-2019-3621-1
Branch p8 update bulletin.
Closed vulnerabilities
BDU:2020-01537
Уязвимость системы хранения данных Ceph, связанная с ошибкой процедуры авторизации, позволяющая нарушителю получить несанкционированный доступ к ключам шифрования dm-crypt
BDU:2020-01538
Уязвимость системы хранения данных Ceph, существующая из-за недостаточной проверки входных данных, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2018-14662
It was found Ceph versions before 13.2.4 that authenticated ceph users with read only permissions could steal dm-crypt encryption keys used in ceph disk encryption.
- openSUSE-SU-2019:1284
- RHSA-2019:2538
- RHSA-2019:2541
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14662
- https://ceph.com/releases/13-2-4-mimic-released
- [debian-lts-announce] 20190301 [SECURITY] [DLA 1696-1] ceph security update
- [debian-lts-announce] 20210810 [SECURITY] [DLA 2735-1] ceph security update
- USN-4035-1
- openSUSE-SU-2019:1284
- USN-4035-1
- [debian-lts-announce] 20210810 [SECURITY] [DLA 2735-1] ceph security update
- [debian-lts-announce] 20190301 [SECURITY] [DLA 1696-1] ceph security update
- https://ceph.com/releases/13-2-4-mimic-released
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14662
- RHSA-2019:2541
- RHSA-2019:2538
Modified: 2024-11-21
CVE-2018-16846
It was found in Ceph versions before 13.2.4 that authenticated ceph RGW users can cause a denial of service against OMAPs holding bucket indices.
- openSUSE-SU-2019:1284
- openSUSE-SU-2019:1284
- RHSA-2019:2538
- RHSA-2019:2538
- RHSA-2019:2541
- RHSA-2019:2541
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16846
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16846
- https://ceph.com/releases/13-2-4-mimic-released/
- https://ceph.com/releases/13-2-4-mimic-released/
- [debian-lts-announce] 20190301 [SECURITY] [DLA 1696-1] ceph security update
- [debian-lts-announce] 20190301 [SECURITY] [DLA 1696-1] ceph security update
- [debian-lts-announce] 20210810 [SECURITY] [DLA 2735-1] ceph security update
- [debian-lts-announce] 20210810 [SECURITY] [DLA 2735-1] ceph security update
- USN-4035-1
- USN-4035-1
Modified: 2024-11-21
CVE-2018-16889
Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption key information in log files via plaintext. Versions up to v13.2.4 are vulnerable.