-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2020.4146
Security update for ceph
23 November 2020
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: ceph
Publisher: SUSE
Operating System: SUSE
UNIX variants (UNIX, Linux, OSX)
Impact/Access: Execute Arbitrary Code/Commands -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2020-25660
Original Bulletin:
https://www.suse.com/support/update/announcement/2020/suse-su-20203473-1
Comment: This advisory references vulnerabilities in products which run on
platforms other than SUSE. It is recommended that administrators
running ceph check for an updated version of the software for their
operating system.
- --------------------------BEGIN INCLUDED TEXT--------------------
SUSE Security Update: Security update for ceph
______________________________________________________________________________
Announcement ID: SUSE-SU-2020:3473-1
Rating: moderate
References: #1163764 #1170200 #1170498 #1173079 #1174466 #1174529
#1174644 #1175120 #1175161 #1175169 #1176451 #1176499
#1176638 #1177078 #1177151 #1177319 #1177344 #1177450
#1177643 #1177676 #1177843 #1177933 #1178073 #1178531
Cross-References: CVE-2020-25660
Affected Products:
SUSE Linux Enterprise Module for Basesystem 15-SP2
______________________________________________________________________________
An update that solves one vulnerability, contains two features and has 23 fixes
is now available.
Description:
This update for ceph fixes the following issues:
o CVE-2020-25660: Bring back CEPHX_V2 authorizer challenges (bsc#1177843).
o Added --container-init feature (bsc#1177319, bsc#1163764)
o Made journald as the logdriver again (bsc#1177933)
o Fixes a condition check for copy_tree, copy_files, and move_files in
cephadm (bsc#1177676)
o Fixed a bug where device_health_metrics pool gets created even without any
OSDs in the cluster (bsc#1173079)
o Log cephadm output /var/log/ceph/cephadm.log (bsc#1174644)
o Fixed a bug where the orchestrator didn't come up anymore after the
deletion of OSDs (bsc#1176499)
o Fixed a bug where cephadm fails to deploy all OSDs and gets stuck (bsc#
1177450)
o python-common will no longer skip unavailable disks (bsc#1177151)
o Added snap-schedule module (jsc#SES-704)
o Updated the SES7 downstream branding (bsc#1175120, bsc#1175161, bsc#
1175169, bsc#1170498)
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation
methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
o SUSE Linux Enterprise Module for Basesystem 15-SP2:
zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP2-2020-3473=1
Package List:
o SUSE Linux Enterprise Module for Basesystem 15-SP2 (aarch64 ppc64le s390x
x86_64):
ceph-common-15.2.5.667+g1a579d5bf2-3.5.1
ceph-common-debuginfo-15.2.5.667+g1a579d5bf2-3.5.1
ceph-debugsource-15.2.5.667+g1a579d5bf2-3.5.1
libcephfs-devel-15.2.5.667+g1a579d5bf2-3.5.1
libcephfs2-15.2.5.667+g1a579d5bf2-3.5.1
libcephfs2-debuginfo-15.2.5.667+g1a579d5bf2-3.5.1
librados-devel-15.2.5.667+g1a579d5bf2-3.5.1
librados-devel-debuginfo-15.2.5.667+g1a579d5bf2-3.5.1
librados2-15.2.5.667+g1a579d5bf2-3.5.1
librados2-debuginfo-15.2.5.667+g1a579d5bf2-3.5.1
libradospp-devel-15.2.5.667+g1a579d5bf2-3.5.1
librbd-devel-15.2.5.667+g1a579d5bf2-3.5.1
librbd1-15.2.5.667+g1a579d5bf2-3.5.1
librbd1-debuginfo-15.2.5.667+g1a579d5bf2-3.5.1
librgw-devel-15.2.5.667+g1a579d5bf2-3.5.1
librgw2-15.2.5.667+g1a579d5bf2-3.5.1
librgw2-debuginfo-15.2.5.667+g1a579d5bf2-3.5.1
python3-ceph-argparse-15.2.5.667+g1a579d5bf2-3.5.1
python3-ceph-common-15.2.5.667+g1a579d5bf2-3.5.1
python3-cephfs-15.2.5.667+g1a579d5bf2-3.5.1
python3-cephfs-debuginfo-15.2.5.667+g1a579d5bf2-3.5.1
python3-rados-15.2.5.667+g1a579d5bf2-3.5.1
python3-rados-debuginfo-15.2.5.667+g1a579d5bf2-3.5.1
python3-rbd-15.2.5.667+g1a579d5bf2-3.5.1
python3-rbd-debuginfo-15.2.5.667+g1a579d5bf2-3.5.1
python3-rgw-15.2.5.667+g1a579d5bf2-3.5.1
python3-rgw-debuginfo-15.2.5.667+g1a579d5bf2-3.5.1
rados-objclass-devel-15.2.5.667+g1a579d5bf2-3.5.1
rbd-nbd-15.2.5.667+g1a579d5bf2-3.5.1
rbd-nbd-debuginfo-15.2.5.667+g1a579d5bf2-3.5.1
References:
o https://www.suse.com/security/cve/CVE-2020-25660.html
o https://bugzilla.suse.com/1163764
o https://bugzilla.suse.com/1170200
o https://bugzilla.suse.com/1170498
o https://bugzilla.suse.com/1173079
o https://bugzilla.suse.com/1174466
o https://bugzilla.suse.com/1174529
o https://bugzilla.suse.com/1174644
o https://bugzilla.suse.com/1175120
o https://bugzilla.suse.com/1175161
o https://bugzilla.suse.com/1175169
o https://bugzilla.suse.com/1176451
o https://bugzilla.suse.com/1176499
o https://bugzilla.suse.com/1176638
o https://bugzilla.suse.com/1177078
o https://bugzilla.suse.com/1177151
o https://bugzilla.suse.com/1177319
o https://bugzilla.suse.com/1177344
o https://bugzilla.suse.com/1177450
o https://bugzilla.suse.com/1177643
o https://bugzilla.suse.com/1177676
o https://bugzilla.suse.com/1177843
o https://bugzilla.suse.com/1177933
o https://bugzilla.suse.com/1178073
o https://bugzilla.suse.com/1178531
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBX7tK1ONLKJtyKPYoAQjuCxAAj6Z7oxOqw1LI5EtBWFHtcmsw1mKaj94X
AhDLQ6J1EECHZI3B0pdJqmykMBLoXSzxij53cmnt55H1mMuchmwgdSACWS96g/b1
rf2DfZ8Au9B3LNKvCJTkMOAzxjCwq27zY9lv8kEs7aB2JcotTiCOlml61DxQxFvz
09XVR6RcxZWeCI09+yqNx+jm17jFU0uYS6BDJ67wEJYKF1Fw2V5yOUPR5Vv9qnCo
SzX+6U/wBMeGsbN/eJrnVBqly0nhzBALFyhRD9XUpk27WVezTge+0nkugFlLYDpp
0Iekvh9Gatr39Wvz/gEtbMVhPotrr1Py00PXQvoBfUU7cIFa5+Xw5VZaRVevYKbh
ps2Vl9lAl4Jsu7cVy0LUHNX06hNEw962eA6Y7j0Edjl6TGOc9LU6t1umajelXlRz
ahQnmtysApMgfd06XPdrzveGD1QGQZPL/FxKHnA9+n8xNmWnKB+xELxeUcVhwb1+
29yb45o7KNEV1RRcpoCvzl4TJowl5iwM2dgl0eQfTSNXbtKuQiho5R45bQ0Wn6k8
+qU3amWAGIkuON89zxW5GIQg5NVA05yN7QUQ7hz+SsvdV5z207voftHl3FRDo7zU
jO93kb2frOXmEWLTU9FK43kK8c7d8CQxt1MzVhGpySpFPn3gnJ94T/s0LZWlu2Of
iReBWPx62w8=
=IgqJ
-----END PGP SIGNATURE-----
The post ESB-2020.4146 – [UNIX/Linux][SUSE] ceph: Execute arbitrary code/commands – Existing account appeared first on Malware Devil.
https://malwaredevil.com/2020/11/23/esb-2020-4146-unix-linuxsuse-ceph-execute-arbitrary-code-commands-existing-account/?utm_source=rss&utm_medium=rss&utm_campaign=esb-2020-4146-unix-linuxsuse-ceph-execute-arbitrary-code-commands-existing-account
No comments:
Post a Comment