Synopsis
Important: Red Hat Ceph Storage 4.2 security and bug fix update
Type/Severity
Security Advisory: Important
Topic
An update is now available for Red Hat Ceph Storage 4.2.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Description
The rhceph-4.2 image is based on Red Hat Ceph Storage 4.2 and Red Hat Enterprise Linux.
Security Fix(es):
- grafana: SSRF incorrect access control vulnerability allows unauthenticated users to make grafana send HTTP requests to any URL (CVE-2020-13379)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
Users are directed to the Red Hat Ceph Storage 4.2 Release Notes for information on the most significant of these changes:
https://access.redhat.com/documentation/en-us/red_hat_ceph_storage/4.2/html
/release_notes/
All users of the rhceph-4.2 image are advised to pull this updated image from the Red Hat Ecosystem Catalog.
Solution
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
Affected Products
-
Red Hat Enterprise Linux Server 7 x86_64
-
Red Hat Ceph Storage MON 4 for RHEL 8 x86_64
-
Red Hat Ceph Storage MON 4 for RHEL 7 x86_64
-
Red Hat Ceph Storage OSD 4 for RHEL 8 x86_64
-
Red Hat Ceph Storage OSD 4 for RHEL 7 x86_64
-
Red Hat Enterprise Linux for x86_64 8 x86_64
-
Red Hat Ceph Storage for Power 4 for RHEL 8 ppc64le
-
Red Hat Ceph Storage for Power 4 for RHEL 7 ppc64le
-
Red Hat Ceph Storage MON for Power 4 for RHEL 8 ppc64le
-
Red Hat Ceph Storage MON for Power 4 for RHEL 7 ppc64le
-
Red Hat Ceph Storage OSD for Power 4 for RHEL 8 ppc64le
-
Red Hat Ceph Storage OSD for Power 4 for RHEL 7 ppc64le
-
Red Hat Ceph Storage for IBM z Systems 4 s390x
-
Red Hat Ceph Storage MON for IBM z Systems 4 s390x
-
Red Hat Ceph Storage OSD for IBM z Systems 4 s390x
Fixes
- BZ - 1843640 - CVE-2020-13379 grafana: SSRF incorrect access control vulnerability allows unauthenticated users to make grafana send HTTP requests to any URL
- BZ - 1879672 - /var/log/tcmu-runner.log within tcmu-runner container does not get rotated and log grows without limit.
CVEs
References
Note:
More recent versions of these packages may be available.
Click a package name for more details.
Red Hat Enterprise Linux Server 7
Red Hat Ceph Storage MON 4 for RHEL 8
Red Hat Ceph Storage MON 4 for RHEL 7
Red Hat Ceph Storage OSD 4 for RHEL 8
Red Hat Ceph Storage OSD 4 for RHEL 7
Red Hat Enterprise Linux for x86_64 8
Red Hat Ceph Storage for Power 4 for RHEL 8
Red Hat Ceph Storage for Power 4 for RHEL 7
Red Hat Ceph Storage MON for Power 4 for RHEL 8
Red Hat Ceph Storage MON for Power 4 for RHEL 7
Red Hat Ceph Storage OSD for Power 4 for RHEL 8
Red Hat Ceph Storage OSD for Power 4 for RHEL 7
Red Hat Ceph Storage for IBM z Systems 4
Red Hat Ceph Storage MON for IBM z Systems 4
Red Hat Ceph Storage OSD for IBM z Systems 4