Red Hat Security Advisory: Red Hat Ceph Storage 7.1 security, enhancements, and bug fix update

Fixed packages 134

Vulnerabilities 4

• Critical 9.8
  CVE-2023-49569

  Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients

  A path traversal vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to create and amend files across the filesystem. In the worse case scenario, remote code execution could be achieved. Applications are only …

  go-git go-git scorecard nuclei Debian Ubuntu Azure Linux Wolfi Go
  Jan 12, 2024
• Critical 9.4
  CVE-2023-3128 Public exploit

  Grafana vulnerable to Authentication Bypass by Spoofing

  Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.

  Grafana Grafana Grafana Enterprise grafana Web / CMS Ubuntu Go
  Jun 22, 2023
• High 7.5
  CVE-2023-49568

  Maliciously crafted Git server replies can cause DoS on go-git clients

  A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion …

  go-git go-git zot kots Debian Ubuntu Azure Linux Alpine Wolfi Go
  Jan 12, 2024
• Medium 6.7
  CVE-2023-4822

  Grafana privilege escalation vulnerability

  Grafana is an open-source platform for monitoring and observability. The vulnerability impacts Grafana instances with several organizations, and allows a user with Organization Admin permissions in one organization to change the permissions associated with Or…

  Grafana Grafana Enterprise grafana github.com/grafana/grafana Web / CMS Ubuntu Go
  Oct 16, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#critical
• report
  https://access.redhat.com/security/cve/CVE-2023-3128
• report
  https://access.redhat.com/security/cve/CVE-2023-49568
• report
  https://access.redhat.com/security/cve/CVE-2023-49569
• report
  https://access.redhat.com/security/cve/CVE-2023-4822
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1871333
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1954461
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1954463
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1995152
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2009599
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2029585
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2061627
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2068026
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2068030
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2079815
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2079897
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2089167
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2107014
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2112325
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2125107
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2130292
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2134786
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2136766
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2144472
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2148831
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2149450
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2153468
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2166576
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2172162
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2176297
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2185792
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2190366
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2207713
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2213626
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2213766
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2217499
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2227309
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2227314
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2233659