==========================================================================
Ubuntu Security Notice USN-4528-1
September 22, 2020

ceph vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 18.04 LTS
– Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in Ceph.

Software Description:
– ceph: distributed storage and file system

Details:

Adam Mohammed discovered that Ceph incorrectly handled certain CORS
ExposeHeader tags. A remote attacker could possibly use this issue to
preform an HTTP header injection attack. (CVE-2020-10753)

Lei Cao discovered that Ceph incorrectly handled certain POST requests with
invalid tagging XML. A remote attacker could possibly use this issue to
cause Ceph to crash, leading to a denial of service. This issue only
affected Ubuntu 18.04 LTS. (CVE-2020-12059)

Robin H. Johnson discovered that Ceph incorrectly handled certain S3
requests. A remote attacker could possibly use this issue to perform a
XSS attack. (CVE-2020-1760)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS:
ceph 12.2.13-0ubuntu0.18.04.4
ceph-base 12.2.13-0ubuntu0.18.04.4
ceph-common 12.2.13-0ubuntu0.18.04.4

Ubuntu 16.04 LTS:
ceph 10.2.11-0ubuntu0.16.04.3
ceph-common 10.2.11-0ubuntu0.16.04.3

In general, a standard system update will make all the necessary changes.

References:
https://usn.ubuntu.com/4528-1
CVE-2020-10753, CVE-2020-12059, CVE-2020-1760

Package Information:
https://launchpad.net/ubuntu/+source/ceph/12.2.13-0ubuntu0.18.04.4
https://launchpad.net/ubuntu/+source/ceph/10.2.11-0ubuntu0.16.04.3

—–BEGIN PGP SIGNATURE—–

iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAl9p8QUACgkQZWnYVadE
vpNmmxAAlYhdC2AKFiNU1iIrYlrTDAt2tuI3K56hcZTKLfsM+9IdDb8RhWaP6Wur
ZNj+bjYf083JKJVr32NARKY0nceykSIRxPmUcge0OJS6NZYvh10YCPVYIs/1aklp
cwr0ylydFxP8GWdeAvENpmiXP7AQixZGhQMNYseVnmBaJ+SPR/jrssy0mYU1GpHL
ZiVAOeecTIZIUXqssND1uPSS+S+EMrxcDlZ0Y4rO8rxKUV9mBLbxyvnxOmjqc4iq
8FLWK0dK4KfBiAsvA0T7iatn9ZAxo8+qC/V2oEpHMuXKS9Erx7OhyRdyDey7MkZo
3mYl3Yw155wIfxfofsWrh0M7yyPkT1Q+rT+FG0NRdwOUHOG+e+3BdBEVhk4a9N2P
sJmCyjVb9Gk3ZF7M110frEeSr+nyLhwvqqd+xxkxOs5QNhWsiI0iCT0DFOA39g+A
aN9GB41p4QGcDj2RjBbwHqZoF1iYCzUmXALIRHJAqjYI3L7oeNQYuAntO7nNDBLT
+BYiZCEgI4GzKqBqoQ2uVkEg4yldh9Bc5pEEmSiw0RUcX/g42qmUHezH76rnddSq
kKPQ7ko0CDV3HnUBrmi1b0EIM5p9ex3sg+cI3J4IXCJI1duJ/d2FJnwHQ6B4SWrF
pNuDfCqPP17P6/YCypwpSF4aBQuljwF5F1IeTpwwJT4X15esnK8=
=fxNb
—–END PGP SIGNATURE—–
—