==========================================================================
Ubuntu Security Notice USN-4528-1
September 22, 2020
ceph vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
– Ubuntu 18.04 LTS
– Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in Ceph.
Software Description:
– ceph: distributed storage and file system
Details:
Adam Mohammed discovered that Ceph incorrectly handled certain CORS
ExposeHeader tags. A remote attacker could possibly use this issue to
preform an HTTP header injection attack. (CVE-2020-10753)
Lei Cao discovered that Ceph incorrectly handled certain POST requests with
invalid tagging XML. A remote attacker could possibly use this issue to
cause Ceph to crash, leading to a denial of service. This issue only
affected Ubuntu 18.04 LTS. (CVE-2020-12059)
Robin H. Johnson discovered that Ceph incorrectly handled certain S3
requests. A remote attacker could possibly use this issue to perform a
XSS attack. (CVE-2020-1760)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS:
ceph 12.2.13-0ubuntu0.18.04.4
ceph-base 12.2.13-0ubuntu0.18.04.4
ceph-common 12.2.13-0ubuntu0.18.04.4
Ubuntu 16.04 LTS:
ceph 10.2.11-0ubuntu0.16.04.3
ceph-common 10.2.11-0ubuntu0.16.04.3
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4528-1
CVE-2020-10753, CVE-2020-12059, CVE-2020-1760
Package Information:
https://launchpad.net/ubuntu/+source/ceph/12.2.13-0ubuntu0.18.04.4
https://launchpad.net/ubuntu/+source/ceph/10.2.11-0ubuntu0.16.04.3
—–BEGIN PGP SIGNATURE—–
iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAl9p8QUACgkQZWnYVadE
vpNmmxAAlYhdC2AKFiNU1iIrYlrTDAt2tuI3K56hcZTKLfsM+9IdDb8RhWaP6Wur
ZNj+bjYf083JKJVr32NARKY0nceykSIRxPmUcge0OJS6NZYvh10YCPVYIs/1aklp
cwr0ylydFxP8GWdeAvENpmiXP7AQixZGhQMNYseVnmBaJ+SPR/jrssy0mYU1GpHL
ZiVAOeecTIZIUXqssND1uPSS+S+EMrxcDlZ0Y4rO8rxKUV9mBLbxyvnxOmjqc4iq
8FLWK0dK4KfBiAsvA0T7iatn9ZAxo8+qC/V2oEpHMuXKS9Erx7OhyRdyDey7MkZo
3mYl3Yw155wIfxfofsWrh0M7yyPkT1Q+rT+FG0NRdwOUHOG+e+3BdBEVhk4a9N2P
sJmCyjVb9Gk3ZF7M110frEeSr+nyLhwvqqd+xxkxOs5QNhWsiI0iCT0DFOA39g+A
aN9GB41p4QGcDj2RjBbwHqZoF1iYCzUmXALIRHJAqjYI3L7oeNQYuAntO7nNDBLT
+BYiZCEgI4GzKqBqoQ2uVkEg4yldh9Bc5pEEmSiw0RUcX/g42qmUHezH76rnddSq
kKPQ7ko0CDV3HnUBrmi1b0EIM5p9ex3sg+cI3J4IXCJI1duJ/d2FJnwHQ6B4SWrF
pNuDfCqPP17P6/YCypwpSF4aBQuljwF5F1IeTpwwJT4X15esnK8=
=fxNb
—–END PGP SIGNATURE—–
—
