CVE-2020-25660

A flaw was found in the Cephx authentication protocol in versions before 15.2.6 and before 14.2.14, where it does not verify Ceph clients correctly and is then vulnerable to replay attacks in Nautilus. This flaw allows an attacker with access to the Ceph cluster network to authenticate with the Ceph service via a packet sniffer and perform actions allowed by the Ceph service. This issue is a reintroduction of CVE-2018-1128, affecting the msgr2 protocol. The msgr 2 protocol is used for all communication except older clients that do not support the msgr2 protocol. The msgr1 protocol is not affected. The highest threat from this vulnerability is to confidentiality, integrity, and system availability.

A flaw was found in the Cephx authentication protocol in versions before 15.2.6 and before 14.2.14, where it does not verify Ceph clients correctly and is then vulnerable to replay attacks in Nautilus. This flaw allows an attacker with access to the Ceph cluster network to authenticate with the Ceph service via a packet sniffer and perform actions allowed by the Ceph service. This issue is a reintroduction of CVE-2018-1128, affecting the msgr2 protocol. The msgr 2 protocol is used for all communication except older clients that do not support the msgr2 protocol. The msgr1 protocol is not affected. The highest threat from this vulnerability is to confidentiality, integrity, and system availability.

This update for ceph fixes the following issues:

• CVE-2020-25660: Bring back CEPHX_V2 authorizer challenges (bsc#1177843).
• Major batch refactor of ceph-volume that addresses a couple of issues (bsc#1151612, bsc#1158257)
• Documented Prometheus' security model (bsc#1169134)
• monclient: Fixed an issue where executing several ceph commands in a short amount of time led to a segmentation fault (bsc#1170487)
• Fixed an issue, where it was not possible to edit an iSCSI logged-in client (bsc#1174591)
• Fixed an issue, where OSDs could not get started after they failed (bsc#1175061)
• Fixed an issue with the restful module, where it aborted on execution for POST calls (bsc#1175240)
• Fixed a many-to-many issue in host-details Grafana dashboard (bsc#1175585)
• Fixed collection_list ordering in os/bluestore (bsc#1172546)
• Fixed help output of lvmcache (bsc#1175781)

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for ceph fixes the following issues:

• CVE-2020-25660: Bring back CEPHX_V2 authorizer challenges (bsc#1177843).
• Added --container-init feature (bsc#1177319, bsc#1163764)
• Made journald as the logdriver again (bsc#1177933)
• Fixes a condition check for copy_tree, copy_files, and move_files in cephadm (bsc#1177676)
• Fixed a bug where device_health_metrics pool gets created even without any OSDs in the cluster (bsc#1173079)
• Log cephadm output /var/log/ceph/cephadm.log (bsc#1174644)
• Fixed a bug where the orchestrator didn't come up anymore after the deletion of OSDs (bsc#1176499)
• Fixed a bug where cephadm fails to deploy all OSDs and gets stuck (bsc#1177450)
• python-common will no longer skip unavailable disks (bsc#1177151)
• Added snap-schedule module (jsc#SES-704)
• Updated the SES7 downstream branding (bsc#1175120, bsc#1175161, bsc#1175169, bsc#1170498)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

These are all security issues fixed in the ceph-16.2.6.463+g22e7612f9ad-1.1 package on the GA media of openSUSE Tumbleweed.

This update for ceph fixes the following issues:

• CVE-2020-25660: Bring back CEPHX_V2 authorizer challenges (bsc#1177843).
• Major batch refactor of ceph-volume that addresses a couple of issues (bsc#1151612, bsc#1158257)
• Documented Prometheus' security model (bsc#1169134)
• monclient: Fixed an issue where executing several ceph commands in a short amount of time led to a segmentation fault (bsc#1170487)
• Fixed an issue, where it was not possible to edit an iSCSI logged-in client (bsc#1174591)
• Fixed an issue, where OSDs could not get started after they failed (bsc#1175061)
• Fixed an issue with the restful module, where it aborted on execution for POST calls (bsc#1175240)
• Fixed a many-to-many issue in host-details Grafana dashboard (bsc#1175585)
• Fixed collection_list ordering in os/bluestore (bsc#1172546)
• Fixed help output of lvmcache (bsc#1175781)

This update for ceph fixes the following issues:

• CVE-2020-25660: Bring back CEPHX_V2 authorizer challenges (bsc#1177843).
• Added --container-init feature (bsc#1177319, bsc#1163764)
• Made journald as the logdriver again (bsc#1177933)
• Fixes a condition check for copy_tree, copy_files, and move_files in cephadm (bsc#1177676)
• Fixed a bug where device_health_metrics pool gets created even without any OSDs in the cluster (bsc#1173079)
• Log cephadm output /var/log/ceph/cephadm.log (bsc#1174644)
• Fixed a bug where the orchestrator didn't come up anymore after the deletion of OSDs (bsc#1176499)
• Fixed a bug where cephadm fails to deploy all OSDs and gets stuck (bsc#1177450)
• python-common will no longer skip unavailable disks (bsc#1177151)
• Added snap-schedule module (jsc#SES-704)
• Updated the SES7 downstream branding (bsc#1175120, bsc#1175161, bsc#1175169, bsc#1170498)

This update for ceph fixes the following issues:

• CVE-2020-25660: Bring back CEPHX_V2 authorizer challenges (bsc#1177843).
• Added --container-init feature (bsc#1177319, bsc#1163764)
• Made journald as the logdriver again (bsc#1177933)
• Fixes a condition check for copy_tree, copy_files, and move_files in cephadm (bsc#1177676)
• Fixed a bug where device_health_metrics pool gets created even without any OSDs in the cluster (bsc#1173079)
• Log cephadm output /var/log/ceph/cephadm.log (bsc#1174644)
• Fixed a bug where the orchestrator didn't come up anymore after the deletion of OSDs (bsc#1176499)
• Fixed a bug where cephadm fails to deploy all OSDs and gets stuck (bsc#1177450)
• python-common will no longer skip unavailable disks (bsc#1177151)
• Added snap-schedule module (jsc#SES-704)
• Updated the SES7 downstream branding (bsc#1175120, bsc#1175161, bsc#1175169, bsc#1170498)

This update for ceph fixes the following issues:

Security issue fixed:

• CVE-2020-25660: Bring back CEPHX_V2 authorizer challenges (bsc#1177843).

• mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically (bsc#1170200)

• mon: have 'mon stat' output json as well (bsc#1174466)

• mgr/dashboard: support Orchestrator and user-defined Ganesha cluster (bsc#1177344)

• mgr/dashboard: fix downstream NFS doc links (bsc#1178073)

• cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph (bsc#1178531)

Olle Segerdahl found that ceph-mon and ceph-mgr daemons did not properly restrict access, resulting in gaining access to unauthorized resources. An authenticated user could use this vulnerability to modify the configuration and possibly conduct further attacks. (CVE-2020-10736)

Adam Mohammed found that Ceph Object Gateway was vulnerable to HTTP header injection via a CORS ExposeHeader tag. An attacker could use this to gain access or cause a crash. (CVE-2020-10753)

Ilya Dryomov found that Cephx authentication did not verify Ceph clients correctly and was then vulnerable to replay attacks in Nautilus. An attacker could use the Ceph cluster network to authenticate via a packet sniffer and perform actions. This issue is a reintroduction of CVE-2018-1128. (CVE-2020-25660)