Red Hat Security Advisory: Red Hat Ceph Storage 6.1 security, enhancement, and bug fix update

Fixed packages 56

Vulnerabilities 6

• High 7.5
  CVE-2023-44487 Exploited Public exploit EPSS 100%

  HTTP/2 Stream Cancellation Attack

  The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

  nodejs golang go kubescape Debian Ubuntu Azure Linux Alpine Wolfi Maven Go SwiftURL
  Oct 10, 2023

  KEV Oct 10, 2023
• Medium 6.5
  CVE-2023-43040 Public exploit

  IBM Spectrum Fusion HCI improper access control

  IBM Spectrum Fusion HCI 2.5.2 through 2.7.2 could allow an attacker to perform unauthorized actions in RGW for Ceph due to improper bucket access. IBM X-Force ID: 266807.

  IBM Spectrum Fusion HCI ceph ceph Debian Ubuntu Azure Linux
  May 13, 2024
• Medium 6.1
  CVE-2018-14041 Public exploit

  Bootstrap Cross-site Scripting vulnerability

  In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy.

  typo3/cms typo3/cms-core bootstrap org.webjars:bootstrap npm Packagist Maven NuGet RubyGems
  Jul 13, 2018
• Medium 6.1
  CVE-2018-20676

  XSS vulnerability that affects bootstrap

  In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.

  twitter-bootstrap3 bootstrap twitter-bootstrap3 twbs/bootstrap Debian Ubuntu npm Packagist Maven NuGet RubyGems
  Jan 9, 2019
• Medium 6.1
  CVE-2018-20677

  bootstrap Cross-site Scripting vulnerability

  In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.

  ceph fluent-bit pytorch twitter-bootstrap3 Debian Ubuntu Azure Linux npm Packagist Maven NuGet RubyGems
  Jan 9, 2019
• Low 2.6
  CVE-2023-46159

  IBM Storage Ceph denial of service

  IBM Storage Ceph 5.3z1, 5.3z5, and 6.1z1 could allow an authenticated user on the network to cause a denial of service from RGW. IBM X-Force ID: 268906.

  IBM Storage Ceph
  Feb 2, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_ceph_storage/6.1/html/release_notes/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1601616
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1668082
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1668089
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1960643
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2088172
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2114615
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2138216
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2141003
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2161569
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2166413
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2166688
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2170836
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2172838
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2183926
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2188557
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2203397
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2210944
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2211290
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2211477
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2212787
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2214278
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2215392
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2216230
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2216855
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2216920
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2217817
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2219465
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2220922
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2222720
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2222726
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2223990
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2224230
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2224233
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2224239
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2224243
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2224407
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2227045