Summary
It was discovered that Ceph incorrectly handled read only permissions. An
authenticated attacker could use this issue to obtain dm-crypt encryption
keys. This issue only affected Ubuntu 16.04 LTS. (CVE-2018-14662)
It was discovered that Ceph incorrectly handled certain OMAPs holding
bucket indices. An authenticated attacker could possibly use this issue to
cause a denial of service. This issue only affected Ubuntu 16.04 LTS.
(CVE-2018-16846)
It was discovered that Ceph incorrectly sanitized certain debug logs. A
local attacker could possibly use this issue to obtain encryption key
information. This issue was only addressed in Ubuntu 18.10 and Ubuntu
19.04. (CVE-2018-16889)
It was discovered that Ceph incorrectly handled certain civetweb requests.
A remote attacker could possibly use this issue to consume resources,
leading to a denial of service. This issue only affected Ubuntu 18.10 and
Ubuntu 19.04. (CVE-2019-3821)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | ceph | 10.2.11-0ubuntu0.16.04.2 |
Vulnerabilities 4
-
High 7.5
A flaw was found in the way civetweb frontend was handling requests for ceph RGW server with SSL enabled. An unauthenti…
-
Medium 6.5
It was found in Ceph versions before 13.2.4 that authenticated ceph RGW users can cause a denial of service against OMA…
-
Medium 5.5
Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption…
-
Low 3.5
It was found Ceph versions before 13.2.4 that authenticated ceph users with read only permissions could steal dm-crypt …