CVE-2021-20288

An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse. An attacker who can request a global_id can exploit the ability of any user to request a global_id previously associated with another user, as ceph does not force the reuse of old keys to generate new ones. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Ceph is a massively scalable, open-source, distributed storage system that runs on commodity hardware and delivers object, block and file system storage.

Security Fix(es):

An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse. An attacker who can request a global_id can exploit the ability of any user to request a global_id previously associated with another user, as ceph does not force the reuse of old keys to generate new ones. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.(CVE-2021-20288)

An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse. An attacker who can request a global_id can exploit the ability of any user to request a global_id previously associated with another user, as ceph does not force the reuse of old keys to generate new ones. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse. An attacker who can request a global_id can exploit the ability of any user to request a global_id previously associated with another user, as ceph does not force the reuse of old keys to generate new ones. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

An authentication flaw was found in ceph. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse. An attacker who can request a global_id can exploit the ability of any user to request a global_id previously associated with another user, as ceph does not force the reuse of old keys to generate new ones. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability (CVE-2021-20288).

This update for ceph fixes the following issues:

• ceph was updated to 15.2.11-83-g8a15f484c2:
  • CVE-2021-20288: Fixed unauthorized global_id reuse (bsc#1183074).
  • disk gets replaced with no rocksdb/wal (bsc#1184231).
  • BlueStore handles huge(>4GB) writes from RocksDB to BlueFS poorly, potentially causing data corruption (bsc#1183899).

This update was imported from the SUSE:SLE-15-SP2:Update update project.

These are all security issues fixed in the benji-0.15.0-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ceph-16.2.6.45+g8fda9838398-1.1 package on the GA media of openSUSE Tumbleweed.

This update for ceph, deepsea fixes the following issues:

• ceph was updated to 14.2.20-402-g6aa76c6815:

  • CVE-2021-20288: Fixed unauthorized global_id reuse (bsc#1183074).
  • CVE-2020-25678: Do not add sensitive information in Ceph log files (bsc#1178905).
  • CVE-2020-27839: Use secure cookies to store JWT Token (bsc#1179997).
  • mgr/dashboard: prometheus alerting: add some leeway for package drops and errors (bsc#1145463)
  • mon: have 'mon stat' output json as well (bsc#1174466)
  • rpm: ceph-mgr-dashboard recommends python3-saml on SUSE (bsc#1177200)
  • mgr/dashboard: Display a warning message in Dashboard when debug mode is enabled (bsc#1178235)
  • rgw: cls/user: set from_index for reset stats calls (bsc#1178837)
  • mgr/dashboard: Disable TLS 1.0 and 1.1 (bsc#1178860)
  • bluestore: provide a different name for fallback allocator (bsc#1180118)
  • test/run-cli-tests: use cram from github (bsc#1181378)
  • mgr/dashboard: fix 'Python2 Cookie module import fails on Python3' (bsc#1183487)
  • common: make ms_bind_msgr2 default to 'false' (bsc#1180594)

• deapsea was updated to 0.9.35

  • osd: add method to zap simple osds (bsc#1178657, bsc#1178216)
  • upgrade to cephadm: fix Drive Group generation (bsc#1181665)
  • Rework config change detection to handle global.conf correctly (bsc#1181183)
  • Use -i to pass credentials to ceph dashboard commands (bsc#1183600)

This update for ceph fixes the following issues:

• ceph was updated to 14.2.20-402-g6aa76c6815:
  • CVE-2021-20288: Fixed unauthorized global_id reuse (bsc#1183074).
  • CVE-2020-25678: Do not add sensitive information in Ceph log files (bsc#1178905).
  • CVE-2020-27839: Use secure cookies to store JWT Token (bsc#1179997).
  • mgr/dashboard: prometheus alerting: add some leeway for package drops and errors (bsc#1145463)
  • mon: have 'mon stat' output json as well (bsc#1174466)
  • rpm: ceph-mgr-dashboard recommends python3-saml on SUSE (bsc#1177200)
  • mgr/dashboard: Display a warning message in Dashboard when debug mode is enabled (bsc#1178235)
  • rgw: cls/user: set from_index for reset stats calls (bsc#1178837)
  • mgr/dashboard: Disable TLS 1.0 and 1.1 (bsc#1178860)
  • bluestore: provide a different name for fallback allocator (bsc#1180118)
  • test/run-cli-tests: use cram from github (bsc#1181378)
  • mgr/dashboard: fix 'Python2 Cookie module import fails on Python3' (bsc#1183487)
  • common: make ms_bind_msgr2 default to 'false' (bsc#1180594)

This update for ceph fixes the following issues:

• ceph was updated to 15.2.11-83-g8a15f484c2:
  • CVE-2021-20288: Fixed unauthorized global_id reuse (bsc#1183074).
  • disk gets replaced with no rocksdb/wal (bsc#1184231).
  • BlueStore handles huge(>4GB) writes from RocksDB to BlueFS poorly, potentially causing data corruption (bsc#1183899).

It was discovered that in some situations Ceph logged passwords from the mgr module in clear text. An attacker could use this to expose sensitive information. (CVE-2020-25678)

Goutham Pacha Ravi, Jahson Babel, and John Garbutt discovered that user credentials in Ceph could be manipulated in certain environments. An attacker could use this to gain unintended access. (CVE-2020-27781)

It was discovered that the Ceph dashboard was susceptible to a cross-site scripting attack. An attacker could use this to expose sensitive information or gain unintended access. (CVE-2020-27839)

It was discovered that Ceph contained an authentication flaw, leading to key reuse. An attacker could use this to cause a denial of service or possibly impersonate another user. (CVE-2021-20288)

Sergey Bobrov discovered that the Ceph dashboard was susceptible to a cross-site scripting attack. An attacker could use this to expose sensitive information or gain unintended access. (CVE-2021-3509)

Sergey Bobrov discovered that Ceph's RadosGW (Ceph Object Gateway) allowed the injection of HTTP headers in responses to CORS requests. An attacker could use this to violate system integrity. (CVE-2021-3524)

It was discovered that Ceph's RadosGW (Ceph Object Gateway) did not properly handle GET requests for swift URLs in some situations, leading to an application crash. An attacker could use this to cause a denial of service. (CVE-2021-3531)

Goutham Pacha Ravi, Jahson Babel, and John Garbutt discovered that user credentials in Ceph could be manipulated in certain environments. An attacker could use this to gain unintended access to resources. This issue only affected Ubuntu 18.04 LTS. (CVE-2020-27781)

It was discovered that Ceph contained an authentication flaw, leading to key reuse. An attacker could use this to cause a denial of service or possibly impersonate another user. This issue only affected Ubuntu 21.04. (CVE-2021-20288)

Sergey Bobrov discovered that the Ceph dashboard was susceptible to a cross-site scripting attack. An attacker could use this to expose sensitive information or gain unintended access. This issue only affected Ubuntu 21.04. (CVE-2021-3509)

Sergey Bobrov discovered that Ceph's RadosGW (Ceph Object Gateway) allowed the injection of HTTP headers in responses to CORS requests. An attacker could use this to violate system integrity. (CVE-2021-3524)

It was discovered that Ceph's RadosGW (Ceph Object Gateway) did not properly handle GET requests for swift URLs in some situations, leading to an application crash. An attacker could use this to cause a denial of service. (CVE-2021-3531)