[gentoo-announce] [ GLSA 202105-39 ] Ceph: Multiple vulnerabilities - gentoo-announce

From:	Thomas Deutschmann <whissi@g.o>
To:	gentoo-announce@l.g.o
Subject:	[gentoo-announce] [ GLSA 202105-39 ] Ceph: Multiple vulnerabilities
Date:	Wed, 26 May 2021 20:59:08
Message-Id:	`8c245dc3-44f3-4ea5-a7f2-8fd690962462@gentoo.org`

1

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

2

Gentoo Linux Security Advisory                           GLSA 202105-39

3

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

4

                                            https://security.gentoo.org/

5

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

6

7

  Severity: Normal

8

     Title: Ceph: Multiple vulnerabilities

9

      Date: May 26, 2021

10

      Bugs: #760824, #761969, #783486, #791253

11

        ID: 202105-39

12

13

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

14

15

Synopsis

16

========

17

18

Multiple vulnerabilities have been found in Ceph, the worst of which

19

could result in privilege escalation.

20

21

Background

22

==========

23

24

Ceph is a distributed network file system designed to provide excellent

25

performance, reliability, and scalability.

26

27

Affected packages

28

=================

29

30

     -------------------------------------------------------------------

31

      Package              /     Vulnerable     /            Unaffected

32

     -------------------------------------------------------------------

33

   1  sys-cluster/ceph            < 14.2.21                 >= 14.2.21

34

35

Description

36

===========

37

38

Multiple vulnerabilities have been discovered in Ceph. Please review

39

the CVE identifiers referenced below for details.

40

41

Impact

42

======

43

44

Please review the referenced CVE identifiers for details.

45

46

Workaround

47

==========

48

49

There is no known workaround at this time.

50

51

Resolution

52

==========

53

54

All Ceph users should upgrade to the latest version:

55

56

   # emerge --sync

57

   # emerge --ask --oneshot --verbose ">=sys-cluster/ceph-14.2.21"

58

59

References

60

==========

61

62

[ 1 ] CVE-2020-10753

63

       https://nvd.nist.gov/vuln/detail/CVE-2020-10753

64

[ 2 ] CVE-2020-1759

65

       https://nvd.nist.gov/vuln/detail/CVE-2020-1759

66

[ 3 ] CVE-2020-1760

67

       https://nvd.nist.gov/vuln/detail/CVE-2020-1760

68

[ 4 ] CVE-2020-25660

69

       https://nvd.nist.gov/vuln/detail/CVE-2020-25660

70

[ 5 ] CVE-2020-25678

71

       https://nvd.nist.gov/vuln/detail/CVE-2020-25678

72

[ 6 ] CVE-2020-27781

73

       https://nvd.nist.gov/vuln/detail/CVE-2020-27781

74

[ 7 ] CVE-2021-20288

75

       https://nvd.nist.gov/vuln/detail/CVE-2021-20288

76

77

Availability

78

============

79

80

This GLSA and any updates to it are available for viewing at

81

the Gentoo Security Website:

82

83

  https://security.gentoo.org/glsa/202105-39

84

85

Concerns?

86

=========

87

88

Security is a primary focus of Gentoo Linux and ensuring the

89

confidentiality and security of our users' machines is of utmost

90

importance to us. Any security concerns should be addressed to

91

security@g.o or alternatively, you may file a bug at

92

https://bugs.gentoo.org.

93

94

License

95

=======

96

97

Copyright 2021 Gentoo Foundation, Inc; referenced text

98

belongs to its owner(s).

99

100

The contents of this document are licensed under the

101

Creative Commons - Attribution / Share Alike license.

102

103

https://creativecommons.org/licenses/by-sa/2.5

Gentoo Archives: gentoo-announce

Attachments

1	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2	Gentoo Linux Security Advisory GLSA 202105-39
3	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
4	https://security.gentoo.org/
5	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
6
7	Severity: Normal
8	Title: Ceph: Multiple vulnerabilities
9	Date: May 26, 2021
10	Bugs: #760824, #761969, #783486, #791253
11	ID: 202105-39
12
13	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
14
15	Synopsis
16	========
17
18	Multiple vulnerabilities have been found in Ceph, the worst of which
19	could result in privilege escalation.
20
21	Background
22	==========
23
24	Ceph is a distributed network file system designed to provide excellent
25	performance, reliability, and scalability.
26
27	Affected packages
28	=================
29
30	-------------------------------------------------------------------
31	Package / Vulnerable / Unaffected
32	-------------------------------------------------------------------
33	1 sys-cluster/ceph < 14.2.21 >= 14.2.21
34
35	Description
36	===========
37
38	Multiple vulnerabilities have been discovered in Ceph. Please review
39	the CVE identifiers referenced below for details.
40
41	Impact
42	======
43
44	Please review the referenced CVE identifiers for details.
45
46	Workaround
47	==========
48
49	There is no known workaround at this time.
50
51	Resolution
52	==========
53
54	All Ceph users should upgrade to the latest version:
55
56	# emerge --sync
57	# emerge --ask --oneshot --verbose ">=sys-cluster/ceph-14.2.21"
58
59	References
60	==========
61
62	[ 1 ] CVE-2020-10753
63	https://nvd.nist.gov/vuln/detail/CVE-2020-10753
64	[ 2 ] CVE-2020-1759
65	https://nvd.nist.gov/vuln/detail/CVE-2020-1759
66	[ 3 ] CVE-2020-1760
67	https://nvd.nist.gov/vuln/detail/CVE-2020-1760
68	[ 4 ] CVE-2020-25660
69	https://nvd.nist.gov/vuln/detail/CVE-2020-25660
70	[ 5 ] CVE-2020-25678
71	https://nvd.nist.gov/vuln/detail/CVE-2020-25678
72	[ 6 ] CVE-2020-27781
73	https://nvd.nist.gov/vuln/detail/CVE-2020-27781
74	[ 7 ] CVE-2021-20288
75	https://nvd.nist.gov/vuln/detail/CVE-2021-20288
76
77	Availability
78	============
79
80	This GLSA and any updates to it are available for viewing at
81	the Gentoo Security Website:
82
83	https://security.gentoo.org/glsa/202105-39
84
85	Concerns?
86	=========
87
88	Security is a primary focus of Gentoo Linux and ensuring the
89	confidentiality and security of our users' machines is of utmost
90	importance to us. Any security concerns should be addressed to
91	security@g.o or alternatively, you may file a bug at
92	https://bugs.gentoo.org.
93
94	License
95	=======
96
97	Copyright 2021 Gentoo Foundation, Inc; referenced text
98	belongs to its owner(s).
99
100	The contents of this document are licensed under the
101	Creative Commons - Attribution / Share Alike license.
102
103	https://creativecommons.org/licenses/by-sa/2.5