CVE-2018-16889

Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption key information in log files via plaintext. Versions up to v13.2.4 are vulnerable.

These are all security issues fixed in the ceph-16.2.6.45+g8fda9838398-1.1 package on the GA media of openSUSE Tumbleweed.

This update for ceph fixes the following issues:

Security issues fixed:

• CVE-2018-14662: mon: limit caps allowed to access the config store (bsc#1111177)
• CVE-2018-16846: rgw: enforce bounds on max-keys/max-uploads/max-parts (bsc#1114710)
• CVE-2018-16889: rgw: sanitize customer encryption keys from log output in v4 auth (bsc#1121567)

Non-security issue fixed:

• os/bluestore: avoid frequent allocator dump on bluefs rebalance failure (bsc#1113246)

This update for ceph fixes the following issues:

Security issues fixed:

• CVE-2019-3821: civetweb: fix file descriptor leak (bsc#1125080)
• CVE-2018-16889: rgw: sanitize customer encryption keys from log output in v4 auth (bsc#1121567)

Non-security issues fixed:

• install grafana dashboards world readable (bsc#1136110)
• upgrade results in cluster outage (bsc#1132396)
• ceph status reports 'HEALTH_WARN 3 monitors have not enabled msgr2' (bsc#1124957)
• Dashboard: Opening tcmu-runner perf counters results in a 404 (bsc#1135388)
• RadosGW stopped expiring objects (bsc#1133139)
• Ceph does not recover when rebuilding every OSD (bsc#1133461)

This update for ceph to version 12.2.12-594-g02236657ca fixes the following issues:

Security issues fixed:

• CVE-2018-16889: Fixed missing sanitation of customer encryption keys from log output in v4 auth. (bsc#1121567)

It was discovered that Ceph incorrectly handled read only permissions. An authenticated attacker could use this issue to obtain dm-crypt encryption keys. This issue only affected Ubuntu 16.04 LTS. (CVE-2018-14662)

It was discovered that Ceph incorrectly handled certain OMAPs holding bucket indices. An authenticated attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2018-16846)

It was discovered that Ceph incorrectly sanitized certain debug logs. A local attacker could possibly use this issue to obtain encryption key information. This issue was only addressed in Ubuntu 18.10 and Ubuntu 19.04. (CVE-2018-16889)

It was discovered that Ceph incorrectly handled certain civetweb requests. A remote attacker could possibly use this issue to consume resources, leading to a denial of service. This issue only affected Ubuntu 18.10 and Ubuntu 19.04. (CVE-2019-3821)