Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 183

Export CSV
CVE-2021-3139

tcmu-runner: SCSI target (LIO) write to any block on ILO backstore

In Open-iSCSI tcmu-runner 1.3.x, 1.4.x, and 1.5.x through 1.5.2, xcopy_locate_udev in tcmur_cmd_handler.c lacks a check for transport-layer restrictions, allowing remote attackers to read or write files via directory traversal in an XCOPY request. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. NOTE: relative to CVE-2020-28374, this is a similar mistake in a different algorithm.

CVSS 3.1 · 8.1 High EPSS 2.7% KEV · Not listed
Vendors
Redhat Tcmu-runner Project
Products
Ceph Storage Tcmu-runner
CVE-2021-20288

ceph: Unauthorized global_id reuse in cephx

An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse. An attacker who can request a global_id can exploit the ability of any user to request a global_id previously associated with another user, as ceph does not force the reuse of old keys to generate new ones. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 7.2 High EPSS 2.1% KEV · Not listed
Vendors
Debian Fedoraproject Linuxfoundation and 1 more
Products
Debian Linux Fedora Ceph and 1 more
CVE-2021-20236

zeromq: Stack overflow on server running PUB/XPUB socket

A flaw was found in the ZeroMQ server in versions before 4.3.3. This flaw allows a malicious client to cause a stack buffer overflow on the server by sending crafted topic subscription requests and then unsubscribing. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

CVSS 3.1 · 9.8 Critical EPSS 1.9% KEV · Not listed
Vendors
Fedoraproject Redhat Zeromq
Products
Fedora Ceph Storage Enterprise Linux and 1 more
CVE-2020-27839

ceph-dashboard: Don't use Browser's LocalStorage for storing JWT but Secure Cookies with proper HTTP Headers

A flaw was found in ceph-dashboard. The JSON Web Token (JWT) used for user authentication is stored by the frontend application in the browser’s localStorage which is potentially vulnerable to attackers via XSS attacks. The highest threat from this vulnerability is to data confidentiality and integrity.

CVSS 3.1 · 5.4 Medium EPSS 2.4% KEV · Not listed
Vendors
Redhat
Products
Ceph Ceph Storage
CVE-2020-27781

ceph: User credentials can be manipulated and stolen by Native CephFS consumers of OpenStack Manila

User credentials can be manipulated and stolen by Native CephFS consumers of OpenStack Manila, resulting in potential privilege escalation. An Open Stack Manila user can request access to a share to an arbitrary cephx user, including existing users. The access key is retrieved via the interface drivers. Then, all users of the requesting OpenStack project can view the access key. This enables the attacker to target any resource that the user has access to. This can be done to even "admin" users, compromising the ceph administrator. This flaw affects Ceph versions prior to 14.2.16, 15.x prior to 15.2.8, and 16.x prior to 16.2.0.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Redhat
Products
Fedora Ceph Ceph Storage and 3 more
CVE-2020-25677

ceph-ansible: insecure ownership on /etc/ceph/iscsi-gateway.conf configuration file

A flaw was found in Ceph-ansible v4.0.41 where it creates an /etc/ceph/iscsi-gateway.conf with insecure default permissions. This flaw allows any user on the system to read sensitive information within this file. The highest threat from this vulnerability is to confidentiality.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Ceph Redhat
Products
Ceph-ansible Ceph Storage Openshift Container Storage
CVE-2020-25660

ceph: CEPHX_V2 replay attack protection lost

A flaw was found in the Cephx authentication protocol in versions before 15.2.6 and before 14.2.14, where it does not verify Ceph clients correctly and is then vulnerable to replay attacks in Nautilus. This flaw allows an attacker with access to the Ceph cluster network to authenticate with the Ceph service via a packet sniffer and perform actions allowed by the Ceph service. This issue is a reintroduction of CVE-2018-1128, affecting the msgr2 protocol. The msgr 2 protocol is used for all communication except older clients that do not support the msgr2 protocol. The msgr1 protocol is not affected. The highest threat from this vulnerability is to confidentiality, integrity, and system availability.

CVSS 3.1 · 8.8 High EPSS 1.0% KEV · Not listed
Vendors
Fedoraproject Redhat
Products
Fedora Ceph Ceph Storage and 2 more
CVE-2020-25658

python-rsa: bleichenbacher timing oracle attack against RSA decryption

It was found that python-rsa is vulnerable to Bleichenbacher timing attacks. An attacker can use this flaw via the RSA decryption API to decrypt parts of the cipher text encrypted with RSA.

CVSS 3.1 · 7.5 High EPSS 1.7% KEV · Not listed
Vendors
Fedoraproject Python-rsa Project Redhat
Products
Fedora Python-rsa Ceph Storage and 2 more
CVE-2020-25626

django-rest-framework: XSS Vulnerability in API viewer

A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious <script> tags, leading to a cross-site-scripting (XSS) vulnerability.

CVSS 3.1 · 6.1 Medium EPSS 1.3% KEV · Not listed
Vendors
Debian Encode Redhat
Products
Debian Linux Django Rest Framework Ansible Tower and 1 more
CVE-2020-1760

ceph: header-splitting in RGW GetObject has a possible XSS

A flaw was found in the Ceph Object Gateway, where it supports request sent by an anonymous user in Amazon S3. This flaw could lead to potential XSS attacks due to the lack of proper neutralization of untrusted input.

CVSS 3.1 · 5.8 Medium EPSS 1.5% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 3 more
CVE-2020-1759

ceph: secure mode of msgr2 breaks both confidentiality and integrity aspects for long-lived sessions

A vulnerability was found in Red Hat Ceph Storage 4 and Red Hat Openshift Container Storage 4.2 where, A nonce reuse vulnerability was discovered in the secure mode of the messenger v2 protocol, which can allow an attacker to forge auth tags and potentially manipulate the data by leveraging the reuse of a nonce in a session. Messages encrypted using a reused nonce value are susceptible to serious confidentiality and integrity attacks.

CVSS 3.1 · 6.4 Medium EPSS 1.4% KEV · Not listed
Vendors
Fedoraproject Linuxfoundation Redhat
Products
Fedora Ceph Ceph Storage and 2 more
CVE-2020-1716

ceph-ansible: hard coded credential in ceph-ansible playbook

A flaw was found in the ceph-ansible playbook where it contained hardcoded passwords that were being used as default passwords while deploying Ceph services. Any authenticated attacker can abuse this flaw to brute-force Ceph deployments, and gain administrator access to Ceph clusters via the Ceph dashboard to initiate read, write, and delete Ceph clusters and also modify Ceph cluster configurations. Versions before ceph-ansible 6.0.0alpha1 are affected.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed
Vendors
Ceph Redhat
Products
Ceph-ansible Ceph Storage
CVE-2020-1699

ceph: improper URL checking leads to information disclosure

A path traversal flaw was found in the Ceph dashboard implemented in upstream versions v14.2.5, v14.2.6, v15.0.0 of Ceph storage and has been fixed in versions 14.2.7 and 15.1.0. An unauthenticated attacker could use this flaw to cause information disclosure on the host machine running the Ceph dashboard.

CVSS 3.1 · 7.5 High EPSS 2.1% KEV · Not listed
Vendors
Linuxfoundation Redhat
Products
Ceph Ceph Storage
CVE-2020-14365

ansible: dnf module install packages with no GPG signature

A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disable_gpg_check is set to False, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Debian Redhat
Products
Debian Linux Ansible Engine Ansible Tower and 2 more
CVE-2020-13379

grafana: SSRF incorrect access control vulnerability allows unauthenticated users to make grafana send HTTP requests to any URL

The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network that Grafana is running on. Furthermore, passing invalid URL objects could be used for DOS'ing Grafana via SegFault.

CVSS 3.1 · 8.2 High EPSS 99.9% KEV · Not listed
Vendors
Fedoraproject Grafana Netapp and 2 more
Products
Fedora Grafana E-series Performance Analyzer and 8 more
CVE-2020-12458

grafana: information disclosure through world-readable /var/lib/grafana/grafana.db

An information-disclosure flaw was found in Grafana through 6.7.3. The database directory /var/lib/grafana and database file /var/lib/grafana/grafana.db are world readable. This can result in exposure of sensitive information (e.g., cleartext or encrypted datasource passwords).

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Grafana Redhat
Products
Fedora Grafana Ceph Storage and 1 more
CVE-2020-12059

ceph: specially crafted XML payload on POST requests leads to DoS by crashing RGW

An issue was discovered in Ceph through 13.2.9. A POST request with an invalid tagging XML can crash the RGW process by triggering a NULL pointer exception.

CVSS 3.1 · 7.5 High EPSS 2.4% KEV · Not listed
Vendors
Canonical Linuxfoundation Redhat
Products
Ubuntu Linux Ceph Ceph Storage
CVE-2020-10753

ceph: radosgw: HTTP header injection via CORS ExposeHeader tag

A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway). The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made. Ceph versions 3.x and 4.x are vulnerable to this issue.

CVSS 3.1 · 5.4 Medium EPSS 1.5% KEV · Not listed
Vendors
Canonical Fedoraproject Linuxfoundation and 2 more
Products
Ubuntu Linux Fedora Ceph and 3 more
CVE-2020-10685

Ansible: modules which use files encrypted with vault are not properly cleaned up

A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when using modules which decrypts vault files such as assemble, script, unarchive, win_copy, aws_s3 or copy modules. The temporary directory is created in /tmp leaves the s ts unencrypted. On Operating Systems which /tmp is not a tmpfs but part of the root partition, the directory is only cleared on boot and the decryp emains when the host is switched off. The system will be vulnerable when the system is not running. So decrypted data must be cleared as soon as possible and the data which normally is encrypted ble.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Redhat
Products
Debian Linux Ansible Engine Ansible Tower and 3 more
CVE-2019-19337

ceph: denial of service in RGW daemon

A flaw was found in Red Hat Ceph Storage version 3 in the way the Ceph RADOS Gateway daemon handles S3 requests. An authenticated attacker can abuse this flaw by causing a remote denial of service by sending a specially crafted HTTP Content-Length header to the Ceph RADOS Gateway server.

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Redhat
Products
Ceph Storage