RHEL 8 : Red Hat Ceph Storage 5.1 Security, Enhancement, and Bug Fix update (Moderate) (RHSA-2022:1174)

medium Nessus Plugin ID 159508

Synopsis

The remote Red Hat host is missing one or more security updates.

Description

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:1174 advisory.

Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable version of the Ceph storage system with a Ceph management platform, deployment utilities, and support services.

Security Fix(es):

* ceph object gateway: radosgw: CRLF injection (CVE-2021-3524)

* ceph: RGW unauthenticated denial of service (CVE-2021-3531)

* ceph: Ceph volume does not honour osd_dmcrypt_key_size (CVE-2021-3979)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es)

These new packages include numerous bug fixes and enhancements. space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Ceph Storage Release Notes for information on the most significant of these changes:

https://access.redhat.com/documentation/en-us/red_hat_ceph_storage/5.1/html/release_notes/index

All users of Red Hat Ceph Storage are advised to upgrade to these new packages, which provide numerous enhancements and bug fixes.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

See Also

http://www.nessus.org/u?87913f86

http://www.nessus.org/u?e81707a6

https://access.redhat.com/security/updates/classification/#moderate

https://access.redhat.com/errata/RHSA-2022:1174

https://bugzilla.redhat.com/show_bug.cgi?id=1259160

https://bugzilla.redhat.com/show_bug.cgi?id=1654660

https://bugzilla.redhat.com/show_bug.cgi?id=1728344

https://bugzilla.redhat.com/show_bug.cgi?id=1765484

https://bugzilla.redhat.com/show_bug.cgi?id=1821249

https://bugzilla.redhat.com/show_bug.cgi?id=1835563

https://bugzilla.redhat.com/show_bug.cgi?id=1842808

https://bugzilla.redhat.com/show_bug.cgi?id=1857447

https://bugzilla.redhat.com/show_bug.cgi?id=1858720

https://bugzilla.redhat.com/show_bug.cgi?id=1886120

https://bugzilla.redhat.com/show_bug.cgi?id=1890109

https://bugzilla.redhat.com/show_bug.cgi?id=1890113

https://bugzilla.redhat.com/show_bug.cgi?id=1900127

https://bugzilla.redhat.com/show_bug.cgi?id=1901644

https://bugzilla.redhat.com/show_bug.cgi?id=1905470

https://bugzilla.redhat.com/show_bug.cgi?id=1915362

https://bugzilla.redhat.com/show_bug.cgi?id=1921204

https://bugzilla.redhat.com/show_bug.cgi?id=1926629

https://bugzilla.redhat.com/show_bug.cgi?id=1936370

https://bugzilla.redhat.com/show_bug.cgi?id=1936415

https://bugzilla.redhat.com/show_bug.cgi?id=1936887

https://bugzilla.redhat.com/show_bug.cgi?id=1939064

https://bugzilla.redhat.com/show_bug.cgi?id=1939959

https://bugzilla.redhat.com/show_bug.cgi?id=1940813

https://bugzilla.redhat.com/show_bug.cgi?id=1942510

https://bugzilla.redhat.com/show_bug.cgi?id=1942593

https://bugzilla.redhat.com/show_bug.cgi?id=1943494

https://bugzilla.redhat.com/show_bug.cgi?id=1943967

https://bugzilla.redhat.com/show_bug.cgi?id=1944009

https://bugzilla.redhat.com/show_bug.cgi?id=1944503

https://bugzilla.redhat.com/show_bug.cgi?id=1944769

https://bugzilla.redhat.com/show_bug.cgi?id=1945583

https://bugzilla.redhat.com/show_bug.cgi?id=1946478

https://bugzilla.redhat.com/show_bug.cgi?id=1947024

https://bugzilla.redhat.com/show_bug.cgi?id=1947087

https://bugzilla.redhat.com/show_bug.cgi?id=1947497

https://bugzilla.redhat.com/show_bug.cgi?id=1949359

https://bugzilla.redhat.com/show_bug.cgi?id=1950644

https://bugzilla.redhat.com/show_bug.cgi?id=1951674

https://bugzilla.redhat.com/show_bug.cgi?id=1952120

https://bugzilla.redhat.com/show_bug.cgi?id=1953903

https://bugzilla.redhat.com/show_bug.cgi?id=1954392

https://bugzilla.redhat.com/show_bug.cgi?id=1954971

https://bugzilla.redhat.com/show_bug.cgi?id=1955326

https://bugzilla.redhat.com/show_bug.cgi?id=1955513

https://bugzilla.redhat.com/show_bug.cgi?id=1956601

https://bugzilla.redhat.com/show_bug.cgi?id=1958758

https://bugzilla.redhat.com/show_bug.cgi?id=1958927

https://bugzilla.redhat.com/show_bug.cgi?id=1959159

https://bugzilla.redhat.com/show_bug.cgi?id=1959354

https://bugzilla.redhat.com/show_bug.cgi?id=1959508

https://bugzilla.redhat.com/show_bug.cgi?id=1962744

https://bugzilla.redhat.com/show_bug.cgi?id=1963947

https://bugzilla.redhat.com/show_bug.cgi?id=1964312

https://bugzilla.redhat.com/show_bug.cgi?id=1964453

https://bugzilla.redhat.com/show_bug.cgi?id=1965186

https://bugzilla.redhat.com/show_bug.cgi?id=1966522

https://bugzilla.redhat.com/show_bug.cgi?id=1967122

https://bugzilla.redhat.com/show_bug.cgi?id=1967440

https://bugzilla.redhat.com/show_bug.cgi?id=1968563

https://bugzilla.redhat.com/show_bug.cgi?id=1968579

https://bugzilla.redhat.com/show_bug.cgi?id=1969545

https://bugzilla.redhat.com/show_bug.cgi?id=1970324

https://bugzilla.redhat.com/show_bug.cgi?id=1970549

https://bugzilla.redhat.com/show_bug.cgi?id=1972274

https://bugzilla.redhat.com/show_bug.cgi?id=1973155

https://bugzilla.redhat.com/show_bug.cgi?id=1974882

https://bugzilla.redhat.com/show_bug.cgi?id=1975338

https://bugzilla.redhat.com/show_bug.cgi?id=1976874

https://bugzilla.redhat.com/show_bug.cgi?id=1976920

https://bugzilla.redhat.com/show_bug.cgi?id=1979476

https://bugzilla.redhat.com/show_bug.cgi?id=1979546

https://bugzilla.redhat.com/show_bug.cgi?id=1980785

https://bugzilla.redhat.com/show_bug.cgi?id=1981606

https://bugzilla.redhat.com/show_bug.cgi?id=1981852

https://bugzilla.redhat.com/show_bug.cgi?id=1982277

https://bugzilla.redhat.com/show_bug.cgi?id=1982965

https://bugzilla.redhat.com/show_bug.cgi?id=1982995

https://bugzilla.redhat.com/show_bug.cgi?id=1984368

https://bugzilla.redhat.com/show_bug.cgi?id=1986160

https://bugzilla.redhat.com/show_bug.cgi?id=1988274

https://bugzilla.redhat.com/show_bug.cgi?id=1988287

https://bugzilla.redhat.com/show_bug.cgi?id=1990382

https://bugzilla.redhat.com/show_bug.cgi?id=1997332

https://bugzilla.redhat.com/show_bug.cgi?id=1997964

https://bugzilla.redhat.com/show_bug.cgi?id=1998009

https://bugzilla.redhat.com/show_bug.cgi?id=1998010

https://bugzilla.redhat.com/show_bug.cgi?id=2000085

https://bugzilla.redhat.com/show_bug.cgi?id=2002359

https://bugzilla.redhat.com/show_bug.cgi?id=2002428

https://bugzilla.redhat.com/show_bug.cgi?id=2003207

https://bugzilla.redhat.com/show_bug.cgi?id=2005959

https://bugzilla.redhat.com/show_bug.cgi?id=2005962

https://bugzilla.redhat.com/show_bug.cgi?id=2006174

https://bugzilla.redhat.com/show_bug.cgi?id=2006175

https://bugzilla.redhat.com/show_bug.cgi?id=2006178

https://bugzilla.redhat.com/show_bug.cgi?id=2006184

https://bugzilla.redhat.com/show_bug.cgi?id=2006193

https://bugzilla.redhat.com/show_bug.cgi?id=2006194

https://bugzilla.redhat.com/show_bug.cgi?id=2006217

https://bugzilla.redhat.com/show_bug.cgi?id=2006415

https://bugzilla.redhat.com/show_bug.cgi?id=2006703

https://bugzilla.redhat.com/show_bug.cgi?id=2006949

https://bugzilla.redhat.com/show_bug.cgi?id=2007298

https://bugzilla.redhat.com/show_bug.cgi?id=2007306

https://bugzilla.redhat.com/show_bug.cgi?id=2007516

https://bugzilla.redhat.com/show_bug.cgi?id=2007607

https://bugzilla.redhat.com/show_bug.cgi?id=2008275

https://bugzilla.redhat.com/show_bug.cgi?id=2008587

https://bugzilla.redhat.com/show_bug.cgi?id=2008822

https://bugzilla.redhat.com/show_bug.cgi?id=2008831

https://bugzilla.redhat.com/show_bug.cgi?id=2008858

https://bugzilla.redhat.com/show_bug.cgi?id=2009315

https://bugzilla.redhat.com/show_bug.cgi?id=2009523

https://bugzilla.redhat.com/show_bug.cgi?id=2009552

https://bugzilla.redhat.com/show_bug.cgi?id=2010454

https://bugzilla.redhat.com/show_bug.cgi?id=2011456

https://bugzilla.redhat.com/show_bug.cgi?id=2013176

https://bugzilla.redhat.com/show_bug.cgi?id=2013574

https://bugzilla.redhat.com/show_bug.cgi?id=2014005

https://bugzilla.redhat.com/show_bug.cgi?id=2014500

https://bugzilla.redhat.com/show_bug.cgi?id=2015205

https://bugzilla.redhat.com/show_bug.cgi?id=2016380

https://bugzilla.redhat.com/show_bug.cgi?id=2017449

https://bugzilla.redhat.com/show_bug.cgi?id=2017508

https://bugzilla.redhat.com/show_bug.cgi?id=2017620

https://bugzilla.redhat.com/show_bug.cgi?id=2017621

https://bugzilla.redhat.com/show_bug.cgi?id=2017778

https://bugzilla.redhat.com/show_bug.cgi?id=2017821

https://bugzilla.redhat.com/show_bug.cgi?id=2017880

https://bugzilla.redhat.com/show_bug.cgi?id=2017992

https://bugzilla.redhat.com/show_bug.cgi?id=2018110

https://bugzilla.redhat.com/show_bug.cgi?id=2018140

https://bugzilla.redhat.com/show_bug.cgi?id=2018248

https://bugzilla.redhat.com/show_bug.cgi?id=2018378

https://bugzilla.redhat.com/show_bug.cgi?id=2019978

https://bugzilla.redhat.com/show_bug.cgi?id=2021095

https://bugzilla.redhat.com/show_bug.cgi?id=2021177

https://bugzilla.redhat.com/show_bug.cgi?id=2021311

https://bugzilla.redhat.com/show_bug.cgi?id=2021387

https://bugzilla.redhat.com/show_bug.cgi?id=2021448

https://bugzilla.redhat.com/show_bug.cgi?id=2021458

https://bugzilla.redhat.com/show_bug.cgi?id=2021470

https://bugzilla.redhat.com/show_bug.cgi?id=2021600

https://bugzilla.redhat.com/show_bug.cgi?id=2021738

https://bugzilla.redhat.com/show_bug.cgi?id=2021926

https://bugzilla.redhat.com/show_bug.cgi?id=2022052

https://bugzilla.redhat.com/show_bug.cgi?id=2022190

https://bugzilla.redhat.com/show_bug.cgi?id=2022531

https://bugzilla.redhat.com/show_bug.cgi?id=2023171

https://bugzilla.redhat.com/show_bug.cgi?id=2023377

https://bugzilla.redhat.com/show_bug.cgi?id=2023598

https://bugzilla.redhat.com/show_bug.cgi?id=2024029

https://bugzilla.redhat.com/show_bug.cgi?id=2024154

https://bugzilla.redhat.com/show_bug.cgi?id=2024176

https://bugzilla.redhat.com/show_bug.cgi?id=2024788

https://bugzilla.redhat.com/show_bug.cgi?id=2025497

https://bugzilla.redhat.com/show_bug.cgi?id=2025800

https://bugzilla.redhat.com/show_bug.cgi?id=2025870

https://bugzilla.redhat.com/show_bug.cgi?id=2027374

https://bugzilla.redhat.com/show_bug.cgi?id=2027446

https://bugzilla.redhat.com/show_bug.cgi?id=2027728

https://bugzilla.redhat.com/show_bug.cgi?id=2028247

https://bugzilla.redhat.com/show_bug.cgi?id=2028416

https://bugzilla.redhat.com/show_bug.cgi?id=2028477

https://bugzilla.redhat.com/show_bug.cgi?id=2029455

https://bugzilla.redhat.com/show_bug.cgi?id=2029695

https://bugzilla.redhat.com/show_bug.cgi?id=2029778

https://bugzilla.redhat.com/show_bug.cgi?id=2030617

https://bugzilla.redhat.com/show_bug.cgi?id=2032764

https://bugzilla.redhat.com/show_bug.cgi?id=2032875

https://bugzilla.redhat.com/show_bug.cgi?id=2033543

https://bugzilla.redhat.com/show_bug.cgi?id=2035490

https://bugzilla.redhat.com/show_bug.cgi?id=2035531

https://bugzilla.redhat.com/show_bug.cgi?id=2035566

https://bugzilla.redhat.com/show_bug.cgi?id=2037330

https://bugzilla.redhat.com/show_bug.cgi?id=2037349

https://bugzilla.redhat.com/show_bug.cgi?id=2037691

https://bugzilla.redhat.com/show_bug.cgi?id=2037768

https://bugzilla.redhat.com/show_bug.cgi?id=2037990

https://bugzilla.redhat.com/show_bug.cgi?id=2038036

https://bugzilla.redhat.com/show_bug.cgi?id=2039276

https://bugzilla.redhat.com/show_bug.cgi?id=2039413

https://bugzilla.redhat.com/show_bug.cgi?id=2039899

https://bugzilla.redhat.com/show_bug.cgi?id=2040243

https://bugzilla.redhat.com/show_bug.cgi?id=2040528

https://bugzilla.redhat.com/show_bug.cgi?id=2041660

https://bugzilla.redhat.com/show_bug.cgi?id=2042692

https://bugzilla.redhat.com/show_bug.cgi?id=2044756

https://bugzilla.redhat.com/show_bug.cgi?id=2044836

https://bugzilla.redhat.com/show_bug.cgi?id=2044978

https://bugzilla.redhat.com/show_bug.cgi?id=2045886

https://bugzilla.redhat.com/show_bug.cgi?id=2048734

https://bugzilla.redhat.com/show_bug.cgi?id=2049542

https://bugzilla.redhat.com/show_bug.cgi?id=2049851

https://bugzilla.redhat.com/show_bug.cgi?id=2050261

https://bugzilla.redhat.com/show_bug.cgi?id=2051525

https://bugzilla.redhat.com/show_bug.cgi?id=2051894

https://bugzilla.redhat.com/show_bug.cgi?id=2052205

https://bugzilla.redhat.com/show_bug.cgi?id=2052614

https://bugzilla.redhat.com/show_bug.cgi?id=2052616

https://bugzilla.redhat.com/show_bug.cgi?id=2052927

https://bugzilla.redhat.com/show_bug.cgi?id=2053645

https://bugzilla.redhat.com/show_bug.cgi?id=2053652

https://bugzilla.redhat.com/show_bug.cgi?id=2057414

https://bugzilla.redhat.com/show_bug.cgi?id=2057496

https://bugzilla.redhat.com/show_bug.cgi?id=2057528

https://bugzilla.redhat.com/show_bug.cgi?id=2058047

https://bugzilla.redhat.com/show_bug.cgi?id=2058049

https://bugzilla.redhat.com/show_bug.cgi?id=2059452

https://bugzilla.redhat.com/show_bug.cgi?id=2060519

https://bugzilla.redhat.com/show_bug.cgi?id=2062627

https://bugzilla.redhat.com/show_bug.cgi?id=2063702

https://bugzilla.redhat.com/show_bug.cgi?id=2064327

https://bugzilla.redhat.com/show_bug.cgi?id=2069407

Plugin Details

Severity: Medium

ID: 159508

File Name: redhat-RHSA-2022-1174.nasl

Version: 1.11

Type: local

Agent: unix

Published: 4/5/2022

Updated: 11/7/2024

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.6

Vendor

Vendor Severity: Moderate

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.2

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2021-3524

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS Score Source: CVE-2021-3979

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:python3-ceph-argparse, p-cpe:/a:redhat:enterprise_linux:librgw2, p-cpe:/a:redhat:enterprise_linux:ceph-mgr-diskprediction-local, p-cpe:/a:redhat:enterprise_linux:cephfs-mirror, p-cpe:/a:redhat:enterprise_linux:libradospp-devel, p-cpe:/a:redhat:enterprise_linux:python3-ceph-common, p-cpe:/a:redhat:enterprise_linux:libradosstriper1, p-cpe:/a:redhat:enterprise_linux:ceph-osd, p-cpe:/a:redhat:enterprise_linux:ceph-mgr, p-cpe:/a:redhat:enterprise_linux:ceph-grafana-dashboards, p-cpe:/a:redhat:enterprise_linux:librgw-devel, p-cpe:/a:redhat:enterprise_linux:ceph-mgr-k8sevents, p-cpe:/a:redhat:enterprise_linux:cephadm, p-cpe:/a:redhat:enterprise_linux:librados-devel, p-cpe:/a:redhat:enterprise_linux:librbd-devel, p-cpe:/a:redhat:enterprise_linux:ceph-test, p-cpe:/a:redhat:enterprise_linux:python3-cephfs, p-cpe:/a:redhat:enterprise_linux:ceph-common, p-cpe:/a:redhat:enterprise_linux:ceph-prometheus-alerts, p-cpe:/a:redhat:enterprise_linux:ceph-mds, p-cpe:/a:redhat:enterprise_linux:ceph-resource-agents, p-cpe:/a:redhat:enterprise_linux:cephfs-top, p-cpe:/a:redhat:enterprise_linux:ceph-mgr-dashboard, cpe:/o:redhat:enterprise_linux:8, p-cpe:/a:redhat:enterprise_linux:ceph-radosgw, p-cpe:/a:redhat:enterprise_linux:ceph-mgr-rook, p-cpe:/a:redhat:enterprise_linux:librados2, p-cpe:/a:redhat:enterprise_linux:libcephfs2, p-cpe:/a:redhat:enterprise_linux:ceph, p-cpe:/a:redhat:enterprise_linux:ceph-mgr-modules-core, p-cpe:/a:redhat:enterprise_linux:python3-rados, p-cpe:/a:redhat:enterprise_linux:rbd-nbd, p-cpe:/a:redhat:enterprise_linux:librbd1, p-cpe:/a:redhat:enterprise_linux:ceph-mgr-cephadm, p-cpe:/a:redhat:enterprise_linux:ceph-base, p-cpe:/a:redhat:enterprise_linux:ceph-fuse, p-cpe:/a:redhat:enterprise_linux:rbd-mirror, p-cpe:/a:redhat:enterprise_linux:libcephsqlite, p-cpe:/a:redhat:enterprise_linux:ceph-immutable-object-cache, p-cpe:/a:redhat:enterprise_linux:python3-rbd, p-cpe:/a:redhat:enterprise_linux:ceph-selinux, p-cpe:/a:redhat:enterprise_linux:ceph-mon, p-cpe:/a:redhat:enterprise_linux:python3-rgw, p-cpe:/a:redhat:enterprise_linux:libcephfs-devel

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Exploit Ease: No known exploits are available

Patch Publication Date: 4/4/2022

Vulnerability Publication Date: 5/17/2021

Reference Information

CVE: CVE-2021-3524, CVE-2021-3531, CVE-2021-3979

CWE: 20, 287

RHSA: 2022:1174