Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1111077

Bug#1016069: ceph: CVE-2022-0670

Show all headers | View raw

On 7/26/22 13:16, Moritz Mühlenhoff wrote:
> Source: ceph
> X-Debbugs-CC: team@security.debian.org
> Severity: important
> Tags: security
> 
> Hi,
> 
> The following vulnerability was published for ceph.
> 
> CVE-2022-0670[0]:
> | A flaw was found in Openstack manilla owning a Ceph File system
> | "share", which enables the owner to read/write any manilla share or
> | entire file system. The vulnerability is due to a bug in the "volumes"
> | plugin in Ceph Manager. This allows an attacker to compromise
> | Confidentiality and Integrity of a file system. Fixed in RHCS 5.2 and
> | Ceph 17.2.2.
> 
> https://ceph.io/en/news/blog/2022/v17-2-2-quincy-released/
> 
> If you fix the vulnerability please also make sure to include the
> CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
> 
> For further information see:
> 
> [0] https://security-tracker.debian.org/tracker/CVE-2022-0670
>      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0670
> 
> Please adjust the affected versions in the BTS as needed.
> 

Hi Moritz,

If I'm not mistaking, this security hole is only in the 16.2.x series of 
Ceph, right? I'll upgrade to 16.2.10 immediately. Please let me know 
about Ceph in Bullseye.

Cheers,

Thomas Goirand (zigo)

Back to linux.debian.bugs.dist | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Bug#1016069: ceph: CVE-2022-0670 Moritz Mühlenhoff <jmm@inutil.org> - 2022-07-26 13:30 +0200
  Bug#1016069: ceph: CVE-2022-0670 Thomas Goirand <thomas@goirand.fr> - 2022-07-27 09:20 +0200
    Bug#1016069: ceph: CVE-2022-0670 Thomas Goirand <zigo@debian.org> - 2022-07-27 10:00 +0200
      Bug#1016069: ceph: CVE-2022-0670 Thomas Goirand <zigo@debian.org> - 2022-07-28 15:30 +0200

csiph-web