Improper Authorization in Ceph - CVE-2020-10736

Vulnerability identifier: #VU28173

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-10736

CWE-ID: CWE-285

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to improper authorization, related to mons & mgrs. A remote attacker can pass specially crafted data to the application and bypass implemented security restrictions.

Ceph
ceph (Alpine package)
ceph (Ubuntu package)
ceph-base (Ubuntu package)
ceph-common (Ubuntu package)
Ubuntu

Install updates from vendor's website.

Ceph - update to 15.2.2
ceph (Ubuntu package) - addressed in versions 15.2.7-0ubuntu0.20.04.2, 15.2.7-0ubuntu0.20.10.3
ceph-base (Ubuntu package) - addressed in versions 15.2.7-0ubuntu0.20.04.2, 15.2.7-0ubuntu0.20.10.3
ceph-common (Ubuntu package) - addressed in versions 15.2.7-0ubuntu0.20.04.2, 15.2.7-0ubuntu0.20.10.3

• https://ceph.io/releases/v15-2-2-octopus-released/

• Security restrictions bypass in Ceph
• Improper Authorization in ceph (Alpine package)
• Ubuntu update for ceph