In Ceph before 12.2.3 and 13.x through 13.0.1, the rgw_civetweb.cc RGWCivetWeb::init_env function in radosgw doesn't handle malformed HTTP headers properly, allowing for denial of service.

An update of the ceph package has been released.

An update of {'ceph', 'linux-esx', 'rsync', 'linux', 'linux-secure', 'linux-aws'} packages of Photon OS has been released.

This update for ceph fixes the following issues :

Security issues fixed :

  - CVE-2018-7262: rgw: malformed http headers can crash rgw     (bsc#1081379).

  - CVE-2017-16818: User reachable asserts allow for DoS     (bsc#1063014).

Bug fixes :

  - bsc#1061461: OSDs keep generating coredumps after adding     new OSD node to cluster.

  - bsc#1079076: RGW openssl fixes.

  - bsc#1067088: Upgrade to SES5 restarted all nodes,     majority of OSDs aborts during start.

  - bsc#1056125: Some OSDs are down when doing performance     testing on rbd image in EC Pool.

  - bsc#1087269: allow_ec_overwrites option not in command     options list.

  - bsc#1051598: Fix mountpoint check for systemctl enable
    --runtime.

  - bsc#1070357: Zabbix mgr module doesn't recover from     HEALTH_ERR.

  - bsc#1066502: After upgrading a single OSD from SES 4 to     SES 5 the OSDs do not rejoin the cluster.

  - bsc#1067119: Crushtool decompile creates wrong device     entries (device 20 device20) for not existing / deleted     OSDs.

  - bsc#1060904: Loglevel misleading during keystone     authentication.

  - bsc#1056967: Monitors goes down after pool creation on     cluster with 120 OSDs.

  - bsc#1067705: Issues with RGW Multi-Site Federation     between SES5 and RH Ceph Storage 2.

  - bsc#1059458: Stopping / restarting rados gateway as part     of deepsea stage.4 executions causes core-dump of     radosgw.

  - bsc#1087493: Commvault cannot reconnect to storage after     restarting haproxy.

  - bsc#1066182: Container synchronization between two Ceph     clusters failed.

  - bsc#1081600: Crash in civetweb/RGW.

  - bsc#1054061: NFS-GANESHA service failing while trying to     list mountpoint on client.

  - bsc#1074301: OSDs keep aborting: SnapMapper failed     asserts.

  - bsc#1086340: XFS metadata corruption on rbd-nbd mapped     image with journaling feature enabled.

  - bsc#1080788: fsid mismatch when creating additional     OSDs.

  - bsc#1071386: Metadata spill onto block.slow.

This update was imported from the SUSE:SLE-12-SP3:Update update project.

This update for ceph fixes the following issues: Security issues fixed :

  - CVE-2018-7262: rgw: malformed http headers can crash rgw     (bsc#1081379).

  - CVE-2017-16818: User reachable asserts allow for DoS     (bsc#1063014). Bug fixes :

  - bsc#1061461: OSDs keep generating coredumps after adding     new OSD node to cluster.

  - bsc#1079076: RGW openssl fixes.

  - bsc#1067088: Upgrade to SES5 restarted all nodes,     majority of OSDs aborts during start.

  - bsc#1056125: Some OSDs are down when doing performance     testing on rbd image in EC Pool.

  - bsc#1087269: allow_ec_overwrites option not in command     options list.

  - bsc#1051598: Fix mountpoint check for systemctl enable
    --runtime.

  - bsc#1070357: Zabbix mgr module doesn't recover from     HEALTH_ERR.

  - bsc#1066502: After upgrading a single OSD from SES 4 to     SES 5 the OSDs do not rejoin the cluster.

  - bsc#1067119: Crushtool decompile creates wrong device     entries (device 20 device20) for not existing / deleted     OSDs.

  - bsc#1060904: Loglevel misleading during keystone     authentication.

  - bsc#1056967: Monitors goes down after pool creation on     cluster with 120 OSDs.

  - bsc#1067705: Issues with RGW Multi-Site Federation     between SES5 and RH Ceph Storage 2.

  - bsc#1059458: Stopping / restarting rados gateway as part     of deepsea stage.4 executions causes core-dump of     radosgw.

  - bsc#1087493: Commvault cannot reconnect to storage after     restarting haproxy.

  - bsc#1066182: Container synchronization between two Ceph     clusters failed.

  - bsc#1081600: Crash in civetweb/RGW.

  - bsc#1054061: NFS-GANESHA service failing while trying to     list mountpoint on client.

  - bsc#1074301: OSDs keep aborting: SnapMapper failed     asserts.

  - bsc#1086340: XFS metadata corruption on rbd-nbd mapped     image with journaling feature enabled.

  - bsc#1080788: fsid mismatch when creating additional     OSDs.

  - bsc#1071386: Metadata spill onto block.slow.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:0546 advisory.

    Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable     version of the Ceph storage system with a Ceph management platform, deployment utilities, and support     services.

    Security Fix(es):

    * ceph: Unauthenticated malformed HTTP requests handled by rgw_civetweb.cc:RGW::init_env() can lead to     denial of service (CVE-2018-7262)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

New release (1:12.2.4-1), includes Security fix for CVE-2018-7262

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
121941	Photon OS 2.0: Ceph PHSA-2018-2.0-0041	Nessus	PhotonOS Local Security Checks	high
111300	Photon OS 2.0 : ceph / linux-esx / rsync / linux / linux-secure / linux-aws (PhotonOS-PHSA-2018-2.0-0041) (deprecated)	Nessus	PhotonOS Local Security Checks	high
110257	openSUSE Security Update : ceph (openSUSE-2018-541)	Nessus	SuSE Local Security Checks	high
110123	SUSE SLED12 / SLES12 Security Update : ceph (SUSE-SU-2018:1417-1)	Nessus	SuSE Local Security Checks	high
108480	RHEL 7 : ceph (RHSA-2018:0546)	Nessus	Red Hat Local Security Checks	high
108350	Fedora 27 : 1:ceph (2018-ed907ef9a0)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2018-7262

high

Tenable Plugins

high

high

high

high

high

high