CVE-2022-3650

Ceph: ceph-crash.service allows local ceph user to root exploit

A privilege escalation flaw was found in Ceph. Ceph-crash.service allows a local attacker to escalate privileges to root in the form of a crash dump, and dump privileged information.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Ceph Ceph Storage

CVE-2021-3979

ceph: Ceph volume does not honour osd_dmcrypt_key_size

A key length flaw was found in Red Hat Ceph Storage. An attacker can exploit the fact that the key length is incorrectly passed in an encryption algorithm to create a non random key, which is weaker and can be exploited for loss of confidentiality and integrity on encrypted disks.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Redhat

Products

Fedora Ceph Storage Ceph Storage For Ibm Z Systems and 5 more

CVE-2022-30631

Stack exhaustion when reading certain archives in compress/gzip

Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length compressed files.

CVSS 3.1 · 7.5 High EPSS 2.2% KEV · Not listed

Vendors

Golang Redhat

Products

Go Acm Advanced Cluster Security and 18 more

CVE-2023-49568

Maliciously crafted Git server replies can cause DoS on go-git clients

A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients. Applications using only the in-memory filesystem supported by go-git are not affected by this vulnerability. This is a go-git implementation issue and does not affect the upstream git cli.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Go-git Project Redhat

Products

Go-git Acm Advanced Cluster Security and 7 more

CVE-2024-24557

Moby classic builder cache poisoning

Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some instructions (most important being HEALTHCHECK and ONBUILD) would not cause a cache miss. An attacker with the knowledge of the Dockerfile someone is using could poison their cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps. 23.0+ users are only affected if they explicitly opted out of Buildkit (DOCKER_BUILDKIT=0 environment variable) or are using the /build API endpoint. All users on versions older than 23.0 could be impacted. Image build API endpoint (/build) and ImageBuild function from github.com/docker/docker/client is also affected as it the uses classic builder by default. Patches are included in 24.0.9 and 25.0.2 releases.

CVSS 3.1 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Mobyproject Redhat

Products

Moby Ceph Storage

CVE-2022-21673

OAuth Identity Token exposure in Grafana

Grafana is an open-source platform for monitoring and observability. In affected versions when a data source has the Forward OAuth Identity feature enabled, sending a query to that datasource with an API token (and no other user credentials) will forward the OAuth Identity of the most recently logged-in user. This can allow API token holders to retrieve data for which they may not have intended access. This attack relies on the Grafana instance having data sources that support the Forward OAuth Identity feature, the Grafana instance having a data source with the Forward OAuth Identity feature toggled on, the Grafana instance having OAuth enabled, and the Grafana instance having usable API keys. This issue has been patched in versions 7.5.13 and 8.3.4.

CVSS 3.1 · 4.3 Medium EPSS 2.0% KEV · Not listed

Vendors

Fedoraproject Grafana Redhat

Products

Fedora Grafana Ceph Storage and 2 more

CVE-2022-31130

Grafana data source and plugin proxy endpoints leaking authentication tokens to some destination plugins

Grafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could leak authentication tokens to some destination plugins under some conditions. The vulnerability impacts data source and plugin proxy endpoints with authentication tokens. The destination plugin could receive a user's Grafana authentication token. Versions 9.1.8 and 8.5.14 contain a patch for this issue. As a workaround, do not use API keys, JWT authentication, or any HTTP Header based authentication.

CVSS 3.1 · 4.9 Medium EPSS 1.3% KEV · Not listed

Vendors

Grafana Redhat

Products

Grafana Ceph Storage Enterprise Linux

CVE-2022-39201

Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins

Grafana is an open source observability and data visualization platform. Starting with version 5.0.0-beta1 and prior to versions 8.5.14 and 9.1.8, Grafana could leak the authentication cookie of users to plugins. The vulnerability impacts data source and plugin proxy endpoints under certain conditions. The destination plugin could receive a user's Grafana authentication cookie. Versions 9.1.8 and 8.5.14 contain a patch for this issue. There are no known workarounds.

CVSS 3.1 · 6.8 Medium EPSS 1.7% KEV · Not listed

Vendors

Grafana Redhat

Products

Grafana Ceph Storage Enterprise Linux

CVE-2022-39229

Grafana users with email as a username can block other users from signing in

Grafana is an open source data visualization platform for metrics, logs, and traces. Versions prior to 9.1.8 and 8.5.14 allow one user to block another user's login attempt by registering someone else'e email address as a username. A Grafana user’s username and email address are unique fields, that means no other user can have the same username or email address as another user. A user can have an email address as a username. However, the login system allows users to log in with either username or email address. Since Grafana allows a user to log in with either their username or email address, this creates an usual behavior where `user_1` can register with one email address and `user_2` can register their username as `user_1`’s email address. This prevents `user_1` logging into the application since `user_1`'s password won’t match with `user_2`'s email address. Versions 9.1.8 and 8.5.14 contain a patch. There are no workarounds for this issue.

CVSS 3.1 · 4.3 Medium EPSS 1.1% KEV · Not listed

Vendors

Grafana Redhat

Products

Grafana Ceph Storage Enterprise Linux

CVE-2022-41912

crewjam/saml go library is vulnerable to signature bypass via multiple Assertion elements

The crewjam/saml go library prior to version 0.4.9 is vulnerable to an authentication bypass when processing SAML responses containing multiple Assertion elements. This issue has been corrected in version 0.4.9. There are no workarounds other than upgrading to a fixed version.

CVSS 3.1 · 9.1 Critical EPSS 2.3% KEV · Not listed

Vendors

Redhat Saml Project

Products

Acm Ceph Storage Openshift and 1 more

CVE-2022-23491

Removal of TrustCor root certificate

Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store. TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found in the linked google group discussion.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Certifi Netapp Redhat

Products

Certifi E-series Performance Analyzer Management Services For Element Software and 3 more

CVE-2017-8779

libntirpc: Memory leak when failing to parse XDR strings or bytearrays

rpcbind through 0.2.4, LIBTIRPC through 1.0.1 and 1.0.2-rc through 1.0.2-rc3, and NTIRPC through 1.4.3 do not consider the maximum RPC data size during memory allocation for XDR strings, which allows remote attackers to cause a denial of service (memory consumption with no subsequent free) via a crafted UDP packet to port 111, aka rpcbomb.

CVSS 3.0 · 7.5 High EPSS 81.2% KEV · Not listed

Vendors

Libtirpc Project Ntirpc Project Redhat and 1 more

Products

Libtirpc Ntirpc Ceph Storage and 3 more

CVE-2017-16818

ceph: Failed assertion through user input in ceph_assert() function in rgw_iam_policy.cc

RADOS Gateway in Ceph 12.1.0 through 12.2.1 allows remote authenticated users to cause a denial of service (assertion failure and application exit) by leveraging "full" (not necessarily admin) privileges to post an invalid profile to the admin API, related to rgw/rgw_iam_policy.cc, rgw/rgw_basic_types.h, and rgw/rgw_iam_types.h.

CVSS 3.0 · 6.5 Medium EPSS 2.3% KEV · Not listed

Vendors

Fedoraproject Redhat

Products

Fedora Ceph

CVE-2017-12155

openstack-tripleo-heat-templates: Ceph client keyring is world-readable when deployed by director

A resource-permission flaw was found in the openstack-tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack service, thus potentially reading or modifying data in an OpenStack Block Storage volume.

CVSS 3.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ceph Redhat

Products

Ceph Openstack

CVE-2015-3010

ceph-deploy: keyring permissions are world readable in ~ceph

ceph-deploy before 1.5.23 uses weak permissions (644) for ceph/ceph.client.admin.keyring, which allows local users to obtain sensitive information by reading the file.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Ceph Redhat

Products

Ceph-deploy Ceph Storage

CVE-2015-5245

Ceph: RGW returns requested bucket name raw in Bucket response header

CRLF injection vulnerability in the Ceph Object Gateway (aka radosgw or RGW) in Ceph before 0.94.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted bucket name.

CVSS 2.0 · 4.3 Medium EPSS 1.9% KEV · Not listed

Vendors

Redhat

Products

Ceph Ceph Storage

CVE-2015-4053

ceph-deploy admin command copies keyring file to /etc/ceph which is world readable

The admin command in ceph-deploy before 1.5.25 uses world-readable permissions for /etc/ceph/ceph.client.admin.keyring, which allows local users to obtain sensitive information by reading the file.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Ceph Redhat

Products

Ceph-deploy Ceph Storage

CVE-2016-7031

ceph: RGW permits bucket listing when authenticated_users=read

The RGW code in Ceph before 10.0.1, when authenticated-read ACL is applied to a bucket, allows remote attackers to list the bucket contents via a URL.

CVSS 3.0 · 7.5 High EPSS 1.8% KEV · Not listed

Vendors

Ceph Project Redhat

Products

Ceph Ceph Storage

CVE-2016-5009

crash: mon_command crashes ceph monitors on receiving empty prefix

The handle_command function in mon/Monitor.cc in Ceph allows remote authenticated users to cause a denial of service (segmentation fault and ceph monitor crash) via an (1) empty or (2) crafted prefix.

CVSS 3.0 · 6.5 Medium EPSS 2.5% KEV · Not listed

Vendors

Redhat

Products

Ceph Ceph Storage Ceph Storage Mon and 5 more

CVE-2014-3583

httpd: mod_proxy_fcgi handle_headers() buffer over read

The handle_headers function in mod_proxy_fcgi.c in the mod_proxy_fcgi module in the Apache HTTP Server 2.4.10 allows remote FastCGI servers to cause a denial of service (buffer over-read and daemon crash) via long response headers.

CVSS 2.0 · 5.0 Medium EPSS 10.8% KEV · Not listed

Vendors

Apache Apple Canonical and 1 more

Products

Http Server Mac Os X Os X Server and 3 more