SB2020020806 - OpenSUSE Linux update for ceph

Security Bulletin ID SB2020020806

Severity

Medium

Patch available

YES

Number of vulnerabilities 2

Exploitation vector Remote access

Highest impact Denial of service

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Path traversal (CVE-ID: CVE-2020-1699)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

A path traversal flaw was found in the Ceph dashboard implemented in upstream versions v14.2.5, v14.2.6, v15.0.0 of Ceph storage and has been fixed in versions 14.2.7 and 15.1.0. An unauthenticated attacker could use this flaw to cause information disclosure on the host machine running the Ceph dashboard.

2) Resource management error (CVE-ID: CVE-2020-1700)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an error while processing unexpected disconnects within the Ceph RGW Beast front-end (/rgw/rgw_asio_frontend.cc). A remote attacker can perform a denial of service (DoS) attack by triggering creation of numerous CLOSE_WAIT sockets and exhausting all available system resources.

Remediation

Install update from vendor's website.

References

https://lists.opensuse.org/opensuse-security-announce/2020-02/msg00009.html