ALT-PU-2019-1500

Высокий

ALT-PU-2019-1500: package ceph update to version 14.2.0-alt1

Источник

errata.altlinux.org

Дата публикации

24.03.2019

Дата обновления

24.03.2019

Устраненные уязвимости

ALT Linux branch p11

ALT Container

ALT Education

ALT Workstation

ALT Workstation K

ALT Server

ALT Virtualization PVE Edition

ALT Linux branch p10

ALT Server

ALT Virtualization Server

ALT Workstation

ALT Workstation K

ALT Education

Simply Linux

Starterkit

ALT Container

Описание

This update upgrades ceph to version 14.2.0-alt1.

Устраненные уязвимости3

BDU:2021-03718

Высокий 7.5

Дата публикации: 20.07.2021

Уязвимость системы хранения данных Ceph, связанная с ошибками разыменования указателя, позволяющая нарушителю вызвать отказ в обслуживании

CVSS 3.1

Высокий 7.5

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector: Network
Complexity: Low
Privileges: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

CVSS 2.0

Средний 5

AV:N/AC:L/Au:N/C:N/I:N/A:P

Access vector: Network
Complexity: Low
Authentication: None
Confidentiality: None
Integrity: None
Availability: Partial

Ссылки

BDU:2021-03718 https://bdu.fstec.ru/vul/2021-03718

Ссылки1

ALT-PU-2019-1500 https://errata.altlinux.org/ALT-PU-2019-1500

Связанные уязвимости

CVE-2020-12059

CVSS3: 7.5

ubuntu

больше 6 лет назад

An issue was discovered in Ceph through 13.2.9. A POST request with an invalid tagging XML can crash the RGW process by triggering a NULL pointer exception.

CVE-2020-12059

CVSS3: 6.5

redhat

больше 6 лет назад

An issue was discovered in Ceph through 13.2.9. A POST request with an invalid tagging XML can crash the RGW process by triggering a NULL pointer exception.

CVE-2020-12059

CVSS3: 7.5

nvd

больше 6 лет назад

An issue was discovered in Ceph through 13.2.9. A POST request with an invalid tagging XML can crash the RGW process by triggering a NULL pointer exception.

CVE-2020-12059

CVSS3: 7.5

debian

больше 6 лет назад

An issue was discovered in Ceph through 13.2.9. A POST request with an ...

CVE-2018-16889

CVSS3: 7.5

ubuntu

почти 8 лет назад

Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption key information in log files via plaintext. Versions up to v13.2.4 are vulnerable.