Red Hat Security Advisory: Red Hat Ceph Storage 8.1 security, bug fix, and enhancement updates

Fixed packages 69

Vulnerabilities 8

• Critical 9.8
  CVE-2024-41184

  In the vrrp_ipsets_handler handler (fglobal_parser.c) of keepalived through 2.3.1, an integer overflow can occur. NOTE:…

  keepalived keepalived keepalived Debian Ubuntu Azure Linux
  Jul 18, 2024
• High 8.0
  CVE-2023-46136 Public exploit

  Werkzeug vulnerable to high resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning

  Werkzeug is a comprehensive WSGI web application library. In versions on the 3.x branch prior to 3.0.1 and on the 2.x branch prior to 2.3.8, if an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: a…

  pallets werkzeug airflow-3 kubeflow-pipelines-visualization-server Debian Azure Linux Alpine Wolfi PyPI
  Oct 24, 2023
• High 7.5
  CVE-2023-25577

  Werkzeug may allow high resource usage when parsing multipart form data with many fields

  Werkzeug is a comprehensive WSGI web application library. Prior to version 2.2.3, Werkzeug's multipart form data parser will parse an unlimited number of parts, including file parts. Parts can be a small amount of bytes, but each requires CPU time to parse an…

  pallets werkzeug kubeflow-pipelines-visualization-server werkzeug Debian Ubuntu Azure Linux Wolfi PyPI
  Feb 14, 2023
• High 7.1
  CVE-2024-47191

  pam_oath.so in oath-toolkit 2.6.7 through 2.6.11 before 2.6.12 allows root privilege escalation because, in the context…

  oath-toolkit oath-toolkit oath-toolkit Debian Ubuntu Azure Linux
  Oct 9, 2024
• Medium 6.8
  CVE-2022-23491

  Removal of TrustCor root certificate

  Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process o…

  certifi python-certifi certifi python-certifi Debian Ubuntu PyPI
  Dec 7, 2022
• Medium 6.1
  CVE-2024-42353

  WebOb's location header normalization during redirect leads to open redirect

  WebOb provides objects for HTTP requests and responses. When WebOb normalizes the HTTP Location header to include the request hostname, it does so by parsing the URL that the user is to be redirected to with Python's urlparse, and joining it to the base URL. …

  Pylons webob webob python-webob Debian Ubuntu Azure Linux PyPI
  Aug 14, 2024
• Low 2.6
  CVE-2023-23934

  Wrkzeug's incorrect parsing of nameless cookies leads to __Host- cookies bypass

  Werkzeug is a comprehensive WSGI web application library. Browsers may allow "nameless" cookies that look like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie l…

  pallets werkzeug kubeflow-pipelines-visualization-server werkzeug Debian Ubuntu Azure Linux Wolfi PyPI
  Feb 14, 2023
• Low 2.6
  CVE-2023-46159

  IBM Storage Ceph denial of service

  IBM Storage Ceph 5.3z1, 5.3z5, and 6.1z1 could allow an authenticated user on the network to cause a denial of service from RGW. IBM X-Force ID: 268906.

  IBM Storage Ceph
  Feb 2, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2006083
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2016889
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2047153
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2089305
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2097853
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2110983
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2121519
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2124175
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2129325
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2134003
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2135354
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2146728
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2170242
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2170243
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2180089
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2186791
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2215374
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2237854
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2238814
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2241321
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2242261
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2246310
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2250826
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2251887
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2253832
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2265371
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2268017
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2268019
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2268021
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2268022
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2268046
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2269003
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2274719
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2275856
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2277697
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2279578
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2279814
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2282092