Multiple vulnerabilities in Red Hat Ceph Storage 7



Risk High
Patch available YES
Number of vulnerabilities 9
CVE-ID CVE-2023-23934
CVE-2023-25577
CVE-2023-46446
CVE-2023-48795
CVE-2024-24790
CVE-2024-34069
CVE-2024-42353
CVE-2024-47191
CVE-2024-48916
CWE-ID CWE-20
CWE-400
CWE-345
CWE-326
CWE-94
CWE-601
CWE-287
Exploitation vector Network
Public exploit Public exploit code for vulnerability #4 is available.
Vulnerable software
 ceph (Red Hat package)
Operating systems & Components / Operating system package or component

oath-toolkit (Red Hat package)
Operating systems & Components / Operating system package or component

Red Hat Ceph Storage
Server applications / File servers (FTP/HTTP)

Vendor Red Hat Inc.

Security Bulletin

This security bulletin contains information about 9 vulnerabilities.

1) Input validation error

EUVDB-ID: #VU72340

Risk: Low

CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-23934

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient validation of "nameless" cookies. A remote attacker can manipulate cookie values for an arbitrary domain.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

ceph (Red Hat package): before 18.2.1-329.el8cp

oath-toolkit (Red Hat package): before 2.6.12-1.el8cp

Red Hat Ceph Storage: before 7.1

CPE2.3 External links

https://access.redhat.com/errata/RHSA-2025:4664


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Resource exhaustion

EUVDB-ID: #VU72339

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-25577

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when parsing multipart form data with many fields. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

ceph (Red Hat package): before 18.2.1-329.el8cp

oath-toolkit (Red Hat package): before 2.6.12-1.el8cp

Red Hat Ceph Storage: before 7.1

CPE2.3 External links

https://access.redhat.com/errata/RHSA-2025:4664


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Insufficient verification of data authenticity

EUVDB-ID: #VU84953

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-46446

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

Exploit availability: No

Description

The vulnerability allows a remote user to perform MitM attack.

The vulnerability exists due to missing verification of data authenticity. A remote user can control the remote end of an SSH client session via packet injection/removal and shell emulation.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

ceph (Red Hat package): before 18.2.1-329.el8cp

oath-toolkit (Red Hat package): before 2.6.12-1.el8cp

Red Hat Ceph Storage: before 7.1

CPE2.3 External links

https://access.redhat.com/errata/RHSA-2025:4664


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Inadequate encryption strength

EUVDB-ID: #VU84537

Risk: Low

CVSSv4.0: 2.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2023-48795

CWE-ID: CWE-326 - Inadequate Encryption Strength

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to incorrect implementation of the SSH Binary Packet Protocol (BPP), which mishandles the handshake phase and the use of sequence numbers. A remote attacker can perform MitM attack and delete the SSH2_MSG_EXT_INFO message sent before authentication starts, allowing the attacker to disable a subset of the keystroke timing obfuscation features introduced in OpenSSH 9.5.

The vulnerability was dubbed "Terrapin attack" and it affects both client and server implementations.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

ceph (Red Hat package): before 18.2.1-329.el8cp

oath-toolkit (Red Hat package): before 2.6.12-1.el8cp

Red Hat Ceph Storage: before 7.1

CPE2.3 External links

https://access.redhat.com/errata/RHSA-2025:4664


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

5) Input validation error

EUVDB-ID: #VU91160

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-24790

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to modify application behavior.

The vulnerability exists due to improper handling of IPv4-mapped IPv6 addresses in net/netip within multiple methods, e.g. IsPrivate, IsLoopback. The affected methods return false for addresses which would return true in their traditional IPv4 forms, leading to potential bypass of implemented security features.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

ceph (Red Hat package): before 18.2.1-329.el8cp

oath-toolkit (Red Hat package): before 2.6.12-1.el8cp

Red Hat Ceph Storage: before 7.1

CPE2.3 External links

https://access.redhat.com/errata/RHSA-2025:4664


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Code Injection

EUVDB-ID: #VU89149

Risk: Medium

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-34069

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation within the debugger. A remote attacker can trick the developer to interact with a domain and subdomain they control and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

ceph (Red Hat package): before 18.2.1-329.el8cp

oath-toolkit (Red Hat package): before 2.6.12-1.el8cp

Red Hat Ceph Storage: before 7.1

CPE2.3 External links

https://access.redhat.com/errata/RHSA-2025:4664


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Open redirect

EUVDB-ID: #VU96055

Risk: Low

CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42353

CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

Exploit availability: No

Description

The vulnerability allows a remote attacker to redirect victims to arbitrary URL.

The vulnerability exists due to improper sanitization of user-supplied data. A remote attacker can create a link that leads to a trusted website, however, when clicked, redirects the victim to arbitrary domain.

Successful exploitation of this vulnerability may allow a remote attacker to perform a phishing attack and steal potentially sensitive information.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

ceph (Red Hat package): before 18.2.1-329.el8cp

oath-toolkit (Red Hat package): before 2.6.12-1.el8cp

Red Hat Ceph Storage: before 7.1

CPE2.3 External links

https://access.redhat.com/errata/RHSA-2025:4664


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Improper Authentication

EUVDB-ID: #VU98048

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-47191

CWE-ID: CWE-287 - Improper Authentication

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to an error in pam_oath.so. A local user can overwrite the /etc/shadow file and escalate privileges on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

ceph (Red Hat package): before 18.2.1-329.el8cp

oath-toolkit (Red Hat package): before 2.6.12-1.el8cp

Red Hat Ceph Storage: before 7.1

CPE2.3 External links

https://access.redhat.com/errata/RHSA-2025:4664


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Improper authentication

EUVDB-ID: #VU102357

Risk: High

CVSSv4.0: 8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-48916

CWE-ID: CWE-287 - Improper Authentication

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error when processing authentication requests within the WebTokenEngine::validate_signature() function in src/rgw/rgw_rest_sts.cc. A remote attacker can bypass authentication process and gain unauthorized access to the application.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

ceph (Red Hat package): before 18.2.1-329.el8cp

oath-toolkit (Red Hat package): before 2.6.12-1.el8cp

Red Hat Ceph Storage: before 7.1

CPE2.3 External links

https://access.redhat.com/errata/RHSA-2025:4664


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###