========================================================================== Ubuntu Security Notice USN-4528-1 September 22, 2020
ceph vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: Several security issues were fixed in Ceph. Software Description: - ceph: distributed storage and file system Details: Adam Mohammed discovered that Ceph incorrectly handled certain CORS ExposeHeader tags. A remote attacker could possibly use this issue to preform an HTTP header injection attack. (CVE-2020-10753) Lei Cao discovered that Ceph incorrectly handled certain POST requests with invalid tagging XML. A remote attacker could possibly use this issue to cause Ceph to crash, leading to a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2020-12059) Robin H. Johnson discovered that Ceph incorrectly handled certain S3 requests. A remote attacker could possibly use this issue to perform a XSS attack. (CVE-2020-1760) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 18.04 LTS: ceph 12.2.13-0ubuntu0.18.04.4 ceph-base 12.2.13-0ubuntu0.18.04.4 ceph-common 12.2.13-0ubuntu0.18.04.4 Ubuntu 16.04 LTS: ceph 10.2.11-0ubuntu0.16.04.3 ceph-common 10.2.11-0ubuntu0.16.04.3 In general, a standard system update will make all the necessary changes. References: https://usn.ubuntu.com/4528-1 CVE-2020-10753, CVE-2020-12059, CVE-2020-1760 Package Information: https://launchpad.net/ubuntu/+source/ceph/12.2.13-0ubuntu0.18.04.4 https://launchpad.net/ubuntu/+source/ceph/10.2.11-0ubuntu0.16.04.3
signature.asc
Description: OpenPGP digital signature
-- ubuntu-security-announce mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
