39 results · Feed
-
High 8.1
Ceph RGW SigV4 handler accepts unsigned x-amz-* headers on presigned requests, allowing privilege escalation
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway (RGW) SigV4 handler does not reject requests that carry x-amz-* headers absent from the signed heade…
-
Critical 9.1
Ceph Monitor subscription handler improperly authorizes config-key store reads, exposing cluster secrets to read-only users
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Monitor subscription handler fails to properly authorize access to the configuration-key store, allowing any CephX user …
-
High 8.8
Ceph: CephX AES Authentication error
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the RADOS Gateway (RGW) protects STS session tokens with an AES-128-CBC handler that provides no message authentication, all…
-
High 8.9
Ceph: AES-CBC misuse in CephX and RADOSGW enables authentication bypass and credential forgery
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the CephX authentication protocol encrypts tickets with AES-128-CBC in an unauthenticated mode that uses a hard-coded initia…
-
High 7.5
RGW DoS attack with empty HTTP header in S3 object copy
Ceph is a distributed object, block, and file storage platform. In versions up to and including 19.2.3, using the argument `x-amz-copy-source` to put an object and specifying an empty string as its content leads to the RGW daemon crashing, resulting in a DoS …
-
High 8.1
Ceph is vulnerable to authentication bypass through RadosGW
Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has "none" as JWT alg. And by doing so the JWT signature is not checked. The vulnerability is most likely in the RadosGW OIDC prov…
-
Medium 6.5
CephFS Permission Escalation Vulnerability in Ceph Fuse mounted FS
Ceph is a distributed object, block, and file storage platform. In versions 17.2.7, 18.2.1 through 18.2.4, and 19.0.0 through 19.2.2, an unprivileged user can escalate to root privileges in a ceph-fuse mounted CephFS by chmod 777 a directory owned by root to …
-
Medium 6.5CVE-2023-43040 Public exploit
IBM Spectrum Fusion HCI improper access control
IBM Spectrum Fusion HCI 2.5.2 through 2.7.2 could allow an attacker to perform unauthorized actions in RGW for Ceph due to improper bucket access. IBM X-Force ID: 266807.
-
Medium 6.5
A flaw was found in Ceph, relating to the URL processing on RGW backends. An attacker can exploit the URL processing by…
-
Unscored —
A privilege escalation flaw was found in Ceph. Ceph-crash.service allows a local attacker to escalate privileges to roo…
-
Unscored —
A key length flaw was found in Red Hat Ceph Storage. An attacker can exploit the fact that the key length is incorrectl…
-
Unscored —
A flaw was found in Openstack manilla owning a Ceph File system "share", which enables the owner to read/write any mani…
-
Unscored —
A flaw was found in Red Hat Ceph Storage 4, in the Dashboard component. In response to CVE-2020-27839, the JWT token wa…
-
Unscored —
A flaw was found in ceph-dashboard. The JSON Web Token (JWT) used for user authentication is stored by the frontend app…
-
Unscored —
A flaw was found in the Red Hat Ceph Storage RGW in versions before 14.2.21. When processing a GET Request for a swift …
-
Unscored —
A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in versions before 14.2.21. The vulnerabilit…
-
Unscored —
An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KE…
-
Unscored —
A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in clear text. This can be …
-
Unscored —
User credentials can be manipulated and stolen by Native CephFS consumers of OpenStack Manila, resulting in potential p…
-
Unscored —
A flaw was found in the Cephx authentication protocol in versions before 15.2.6 and before 14.2.14, where it does not v…
-
Medium 5.4
A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway). The vulnerability is related to the injecti…
-
Medium 5.8
A flaw was found in the Ceph Object Gateway, where it supports request sent by an anonymous user in Amazon S3. This fla…
-
Unscored —
An issue was discovered in Ceph through 13.2.9. A POST request with an invalid tagging XML can crash the RGW process by…
-
High 7.5
A path traversal flaw was found in the Ceph dashboard implemented in upstream versions v14.2.5, v14.2.6, v15.0.0 of Cep…
-
Medium 6.4
A vulnerability was found in Red Hat Ceph Storage 4 and Red Hat Openshift Container Storage 4.2 where, A nonce reuse vu…
-
Medium 6.5
A flaw was found in the way the Ceph RGW Beast front-end handles unexpected disconnects. An authenticated attacker can …
-
High 7.5
A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests. An unauthenticated…
-
Medium 5.5
Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption…
-
Low 3.5
It was found Ceph versions before 13.2.4 that authenticated ceph users with read only permissions could steal dm-crypt …
-
Medium 6.5
It was found in Ceph versions before 13.2.4 that authenticated ceph RGW users can cause a denial of service against OMA…
-
Medium 6.5
A flaw was found in the way Ceph Object Gateway would process cross-origin HTTP requests if the CORS policy was set to …
-
Medium 6.5
A flaw was found in Red Hat Ceph before 0.94.9-8. The way Ceph Object Gateway handles POST object requests permits an a…
-
Low 2.3
In Ceph, a format string flaw was found in the way libradosstriper parses input from user. A user could crash an applic…
-
Unscored —
It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay atta…
-
Unscored —
A flaw was found in the way signature calculation was handled by cephx authentication protocol. An attacker having acce…
-
Unscored —
A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can …
-
Unscored —
The RGW code in Ceph before 10.0.1, when authenticated-read ACL is applied to a bucket, allows remote attackers to list…
-
Unscored —
The handle_command function in mon/Monitor.cc in Ceph allows remote authenticated users to cause a denial of service (s…
-
Unscored —
CRLF injection vulnerability in the Ceph Object Gateway (aka radosgw or RGW) in Ceph before 0.94.4 allows remote attack…