Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption key information in log files via plaintext. Versions up to v13.2.4 are vulnerable.

This update for ceph to version 12.2.12-594-g02236657ca fixes the following issues :

Security issues fixed :

CVE-2018-16889: Fixed missing sanitation of customer encryption keys from log output in v4 auth. (bsc#1121567)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update is now available for Red Hat Ceph Storage 3.3 on Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable version of the Ceph storage system with a Ceph management platform, deployment utilities, and support services.

Security Fix(es) :

* ceph: ListBucket max-keys has no defined limit in the RGW codebase (CVE-2018-16846)

* ceph: debug logging for v4 auth does not sanitize encryption keys (CVE-2018-16889)

* ceph: authenticated user with read only permissions can steal dm-crypt / LUKS key (CVE-2018-14662)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es) and Enhancement(s) :

For detailed information on changes in this release, see the Red Hat Ceph Storage 3.3 Release Notes available at :

https://access.redhat.com/documentation/en-us/red_hat_ceph_storage/3.3 /html/ release_notes/index

This update for ceph fixes the following issues :

Security issues fixed :

CVE-2019-3821: civetweb: fix file descriptor leak (bsc#1125080)

CVE-2018-16889: rgw: sanitize customer encryption keys from log output in v4 auth (bsc#1121567)

Non-security issues fixed: install grafana dashboards world readable (bsc#1136110)

upgrade results in cluster outage (bsc#1132396)

ceph status reports 'HEALTH_WARN 3 monitors have not enabled msgr2' (bsc#1124957)

Dashboard: Opening tcmu-runner perf counters results in a 404 (bsc#1135388)

RadosGW stopped expiring objects (bsc#1133139)

Ceph does not recover when rebuilding every OSD (bsc#1133461)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4035-1 advisory.

    It was discovered that Ceph incorrectly handled read only permissions. An authenticated attacker could use     this issue to obtain dm-crypt encryption keys. This issue only affected Ubuntu 16.04 LTS. (CVE-2018-14662)

    It was discovered that Ceph incorrectly handled certain OMAPs holding bucket indices. An authenticated     attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04     LTS. (CVE-2018-16846)

    It was discovered that Ceph incorrectly sanitized certain debug logs. A local attacker could possibly use     this issue to obtain encryption key information. This issue was only addressed in Ubuntu 18.10 and Ubuntu     19.04. (CVE-2018-16889)

    It was discovered that Ceph incorrectly handled certain civetweb requests. A remote attacker could     possibly use this issue to consume resources, leading to a denial of service. This issue only affected     Ubuntu 18.10 and Ubuntu 19.04. (CVE-2019-3821)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the ceph package has been released.

This update for ceph fixes the following issues :

Security issues fixed :

  - CVE-2018-14662: mon: limit caps allowed to access the     config store (bsc#1111177)

  - CVE-2018-16846: rgw: enforce bounds on     max-keys/max-uploads/max-parts (bsc#1114710)

  - CVE-2018-16889: rgw: sanitize customer encryption keys     from log output in v4 auth (bsc#1121567)

Non-security issue fixed :

  - os/bluestore: avoid frequent allocator dump on bluefs     rebalance failure (bsc#1113246)

This update was imported from the SUSE:SLE-12-SP3:Update update project.

This update for ceph fixes the following issues :

Security issues fixed :

CVE-2018-14662: mon: limit caps allowed to access the config store (bsc#1111177)

CVE-2018-16846: rgw: enforce bounds on max-keys/max-uploads/max-parts (bsc#1114710)

CVE-2018-16889: rgw: sanitize customer encryption keys from log output in v4 auth (bsc#1121567)

Non-security issue fixed: os/bluestore: avoid frequent allocator dump on bluefs rebalance failure (bsc#1113246)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New release (1:12.2.11-1) notes=Security fix for CVE-2018-14662, CVE-2018-16846, CVE-2018-16889

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
128871	SUSE SLED12 / SLES12 Security Update : ceph (SUSE-SU-2019:2364-1)	Nessus	SuSE Local Security Checks	high
128106	RHEL 7 : Red Hat Ceph Storage 3.3 (RHSA-2019:2538)	Nessus	Red Hat Local Security Checks	high
127765	SUSE SLED15 / SLES15 Security Update : ceph (SUSE-SU-2019:2049-1)	Nessus	SuSE Local Security Checks	high
126255	Ubuntu 16.04 LTS : Ceph vulnerabilities (USN-4035-1)	Nessus	Ubuntu Local Security Checks	high
125078	Photon OS 2.0: Ceph PHSA-2019-2.0-0154	Nessus	PhotonOS Local Security Checks	high
122742	openSUSE Security Update : ceph (openSUSE-2019-306)	Nessus	SuSE Local Security Checks	high
122476	SUSE SLED12 / SLES12 Security Update : ceph (SUSE-SU-2019:0499-1)	Nessus	SuSE Local Security Checks	high
122323	Fedora 29 : 1:ceph (2019-6a2e72916a)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2018-16889

high

Tenable Plugins

high

high

high

high

high

high

high

high