CVE-2016-8626

A flaw was found in Red Hat Ceph before 0.94.9-8. The way Ceph Object Gateway handles POST object requests permits an authenticated attacker to launch a denial of service attack by sending null or specially crafted POST object requests.

This update provides Ceph 10.2.5, which brings fixes and enhancements:

This security issue was fixed:

• CVE-2016-8626: Handle empty POST condition to not allow attackers to crash the ceph-radosgw service. (bsc#1007217)

These non-security issues were fixed:

• OSD daemon uses 100% CPU load after OSD creation (bsc#1014338)
• ceph-deploy fails with dmcrypt flag (bsc#1008435)
• OSD's are not mounted after upgrade (bsc#1012100)
• ceph-osd service fails to start OSD randomly (bsc#1019616)
• Add missing argument comma to ceph-create-keys (bsc#1008894)
• Add Install section to systemd rbdmap.service file (bsc#1015748)

It was discovered that Ceph incorrectly handled the handle_command function. A remote authenticated user could use this issue to cause Ceph to crash, resulting in a denial of service. (CVE-2016-5009)

Rahul Aggarwal discovered that Ceph incorrectly handled the authenticated-read ACL. A remote attacker could possibly use this issue to list bucket contents via a URL. (CVE-2016-7031)

Diluga Salome discovered that Ceph incorrectly handled certain POST objects with null conditions. A remote attacker could possibly use this issue to cuase Ceph to crash, resulting in a denial of service. (CVE-2016-8626)

Yang Liu discovered that Ceph incorrectly handled invalid HTTP Origin headers. A remote attacker could possibly use this issue to cuase Ceph to crash, resulting in a denial of service. (CVE-2016-9579)