Medium USN-6613-1 1 CVE

ceph vulnerability

Published Jan 29, 2024 · Updated Jun 29, 2026

Ecosystem: Ubuntu

Summary

Lucas Henry discovered that Ceph incorrectly handled specially
crafted POST requests. An uprivileged user could use this to
bypass Ceph's authorization checks and upload a file to any bucket.

Fixed packages 5

Release	Package	Fixed in
Ubuntu · 20.04 LTS 20.04:LTS	ceph	15.2.17-0ubuntu0.20.04.6
Ubuntu · 22.04 LTS 22.04:LTS	ceph	17.2.6-0ubuntu0.22.04.3
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS	ceph	0.80.11-0ubuntu1.14.04.4+esm2
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS	ceph	10.2.11-0ubuntu0.16.04.3+esm1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS	ceph	12.2.13-0ubuntu0.18.04.11+esm1

Vulnerabilities 1

Medium 6.5

CVE-2023-43040 Public exploit

IBM Spectrum Fusion HCI improper access control

IBM Spectrum Fusion HCI 2.5.2 through 2.7.2 could allow an attacker to perform unauthorized actions in RGW for Ceph due to improper bucket access. IBM X-Force ID: 266807.

IBM Spectrum Fusion HCI ceph ceph Debian Ubuntu Azure Linux

May 13, 2024

References

report
https://ubuntu.com/security/CVE-2023-43040