CVE-2020-27839

A flaw was found in ceph-dashboard. The JSON Web Token (JWT) used for user authentication is stored by the frontend application in the browser’s localStorage which is potentially vulnerable to attackers via XSS attacks. The highest threat from this vulnerability is to data confidentiality and integrity.

A flaw was found in Ceph where Ceph stores mgr module passwords in clear text. This issue can be found by searching the mgr logs for Grafana and dashboard with passwords visible. The highest threat from this vulnerability is to confidentiality (CVE-2020-25678).

A flaw was found in ceph-dashboard. The JSON Web Token (JWT) used for user authentication is stored by the frontend application in the browser’s localStorage which is potentially vulnerable to attackers via XSS attacks. The highest threat from this vulnerability is to data confidentiality and integrity (CVE-2020-27839).

This update for ceph fixes the following issues:

• ceph was updated to to 15.2.9
• cephadm: fix 'inspect' and 'pull' (bsc#1182766)
• CVE-2020-27839: mgr/dashboard: Use secure cookies to store JWT Token (bsc#1179997)
• CVE-2020-25678: Do not add sensitive information in Ceph log files (bsc#1178905)
• mgr/orchestrator: Sort 'ceph orch device ls' by host (bsc#1172926)
• mgr/dashboard: enable different URL for users of browser to Grafana (bsc#1176390, bsc#1176679)
• mgr/cephadm: lock multithreaded access to OSDRemovalQueue (bsc#1176489)
• cephadm: command_unit: call systemctl with verbose=True (bsc#1176828)
• cephadm: silence 'Failed to evict container' log msg (bsc#1177360)
• mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails (bsc#1177857)
• rgw: cls/user: set from_index for reset stats calls (bsc#1178837)
• mgr/dashboard: Disable TLS 1.0 and 1.1 (bsc#1178860)
• cephadm: reference the last local image by digest (bsc#1178932, bsc#1179569)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

These are all security issues fixed in the ceph-16.2.6.463+g22e7612f9ad-1.1 package on the GA media of openSUSE Tumbleweed.

This update for ceph fixes the following issues:

• ceph was updated to to 15.2.9
• cephadm: fix 'inspect' and 'pull' (bsc#1182766)
• CVE-2020-27839: mgr/dashboard: Use secure cookies to store JWT Token (bsc#1179997)
• CVE-2020-25678: Do not add sensitive information in Ceph log files (bsc#1178905)
• mgr/orchestrator: Sort 'ceph orch device ls' by host (bsc#1172926)
• mgr/dashboard: enable different URL for users of browser to Grafana (bsc#1176390, bsc#1176679)
• mgr/cephadm: lock multithreaded access to OSDRemovalQueue (bsc#1176489)
• cephadm: command_unit: call systemctl with verbose=True (bsc#1176828)
• cephadm: silence 'Failed to evict container' log msg (bsc#1177360)
• mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails (bsc#1177857)
• rgw: cls/user: set from_index for reset stats calls (bsc#1178837)
• mgr/dashboard: Disable TLS 1.0 and 1.1 (bsc#1178860)
• cephadm: reference the last local image by digest (bsc#1178932, bsc#1179569)

This update for ceph, deepsea fixes the following issues:

• ceph was updated to 14.2.20-402-g6aa76c6815:

  • CVE-2021-20288: Fixed unauthorized global_id reuse (bsc#1183074).
  • CVE-2020-25678: Do not add sensitive information in Ceph log files (bsc#1178905).
  • CVE-2020-27839: Use secure cookies to store JWT Token (bsc#1179997).
  • mgr/dashboard: prometheus alerting: add some leeway for package drops and errors (bsc#1145463)
  • mon: have 'mon stat' output json as well (bsc#1174466)
  • rpm: ceph-mgr-dashboard recommends python3-saml on SUSE (bsc#1177200)
  • mgr/dashboard: Display a warning message in Dashboard when debug mode is enabled (bsc#1178235)
  • rgw: cls/user: set from_index for reset stats calls (bsc#1178837)
  • mgr/dashboard: Disable TLS 1.0 and 1.1 (bsc#1178860)
  • bluestore: provide a different name for fallback allocator (bsc#1180118)
  • test/run-cli-tests: use cram from github (bsc#1181378)
  • mgr/dashboard: fix 'Python2 Cookie module import fails on Python3' (bsc#1183487)
  • common: make ms_bind_msgr2 default to 'false' (bsc#1180594)

• deapsea was updated to 0.9.35

  • osd: add method to zap simple osds (bsc#1178657, bsc#1178216)
  • upgrade to cephadm: fix Drive Group generation (bsc#1181665)
  • Rework config change detection to handle global.conf correctly (bsc#1181183)
  • Use -i to pass credentials to ceph dashboard commands (bsc#1183600)

This update for ceph fixes the following issues:

• ceph was updated to 14.2.20-402-g6aa76c6815:
  • CVE-2021-20288: Fixed unauthorized global_id reuse (bsc#1183074).
  • CVE-2020-25678: Do not add sensitive information in Ceph log files (bsc#1178905).
  • CVE-2020-27839: Use secure cookies to store JWT Token (bsc#1179997).
  • mgr/dashboard: prometheus alerting: add some leeway for package drops and errors (bsc#1145463)
  • mon: have 'mon stat' output json as well (bsc#1174466)
  • rpm: ceph-mgr-dashboard recommends python3-saml on SUSE (bsc#1177200)
  • mgr/dashboard: Display a warning message in Dashboard when debug mode is enabled (bsc#1178235)
  • rgw: cls/user: set from_index for reset stats calls (bsc#1178837)
  • mgr/dashboard: Disable TLS 1.0 and 1.1 (bsc#1178860)
  • bluestore: provide a different name for fallback allocator (bsc#1180118)
  • test/run-cli-tests: use cram from github (bsc#1181378)
  • mgr/dashboard: fix 'Python2 Cookie module import fails on Python3' (bsc#1183487)
  • common: make ms_bind_msgr2 default to 'false' (bsc#1180594)

It was discovered that in some situations Ceph logged passwords from the mgr module in clear text. An attacker could use this to expose sensitive information. (CVE-2020-25678)

Goutham Pacha Ravi, Jahson Babel, and John Garbutt discovered that user credentials in Ceph could be manipulated in certain environments. An attacker could use this to gain unintended access. (CVE-2020-27781)

It was discovered that the Ceph dashboard was susceptible to a cross-site scripting attack. An attacker could use this to expose sensitive information or gain unintended access. (CVE-2020-27839)

It was discovered that Ceph contained an authentication flaw, leading to key reuse. An attacker could use this to cause a denial of service or possibly impersonate another user. (CVE-2021-20288)

Sergey Bobrov discovered that the Ceph dashboard was susceptible to a cross-site scripting attack. An attacker could use this to expose sensitive information or gain unintended access. (CVE-2021-3509)

Sergey Bobrov discovered that Ceph's RadosGW (Ceph Object Gateway) allowed the injection of HTTP headers in responses to CORS requests. An attacker could use this to violate system integrity. (CVE-2021-3524)

It was discovered that Ceph's RadosGW (Ceph Object Gateway) did not properly handle GET requests for swift URLs in some situations, leading to an application crash. An attacker could use this to cause a denial of service. (CVE-2021-3531)