Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1111009 > unrolled thread

Bug#1016069: ceph: CVE-2022-0670

Back to article view | Back to linux.debian.bugs.dist

Contents

  Bug#1016069: ceph: CVE-2022-0670 Moritz Mühlenhoff <jmm@inutil.org> - 2022-07-26 13:30 +0200
    Bug#1016069: ceph: CVE-2022-0670 Thomas Goirand <thomas@goirand.fr> - 2022-07-27 09:20 +0200
      Bug#1016069: ceph: CVE-2022-0670 Thomas Goirand <zigo@debian.org> - 2022-07-27 10:00 +0200
        Bug#1016069: ceph: CVE-2022-0670 Thomas Goirand <zigo@debian.org> - 2022-07-28 15:30 +0200

#1111009 — Bug#1016069: ceph: CVE-2022-0670

Source: ceph
X-Debbugs-CC: team@security.debian.org
Severity: important
Tags: security

Hi,

The following vulnerability was published for ceph.

CVE-2022-0670[0]:
| A flaw was found in Openstack manilla owning a Ceph File system
| "share", which enables the owner to read/write any manilla share or
| entire file system. The vulnerability is due to a bug in the "volumes"
| plugin in Ceph Manager. This allows an attacker to compromise
| Confidentiality and Integrity of a file system. Fixed in RHCS 5.2 and
| Ceph 17.2.2.

https://ceph.io/en/news/blog/2022/v17-2-2-quincy-released/

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2022-0670
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0670

Please adjust the affected versions in the BTS as needed.

[toc] | [next] | [standalone]

#1111077

On 7/26/22 13:16, Moritz Mühlenhoff wrote:
> Source: ceph
> X-Debbugs-CC: team@security.debian.org
> Severity: important
> Tags: security
> 
> Hi,
> 
> The following vulnerability was published for ceph.
> 
> CVE-2022-0670[0]:
> | A flaw was found in Openstack manilla owning a Ceph File system
> | "share", which enables the owner to read/write any manilla share or
> | entire file system. The vulnerability is due to a bug in the "volumes"
> | plugin in Ceph Manager. This allows an attacker to compromise
> | Confidentiality and Integrity of a file system. Fixed in RHCS 5.2 and
> | Ceph 17.2.2.
> 
> https://ceph.io/en/news/blog/2022/v17-2-2-quincy-released/
> 
> If you fix the vulnerability please also make sure to include the
> CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
> 
> For further information see:
> 
> [0] https://security-tracker.debian.org/tracker/CVE-2022-0670
>      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0670
> 
> Please adjust the affected versions in the BTS as needed.
> 

Hi Moritz,

If I'm not mistaking, this security hole is only in the 16.2.x series of 
Ceph, right? I'll upgrade to 16.2.10 immediately. Please let me know 
about Ceph in Bullseye.

Cheers,

Thomas Goirand (zigo)

[toc] | [prev] | [next] | [standalone]

#1111078

On 7/27/22 09:13, Thomas Goirand wrote:
> On 7/26/22 13:16, Moritz Mühlenhoff wrote:
>> Source: ceph
>> X-Debbugs-CC: team@security.debian.org
>> Severity: important
>> Tags: security
>>
>> Hi,
>>
>> The following vulnerability was published for ceph.
>>
>> CVE-2022-0670[0]:
>> | A flaw was found in Openstack manilla owning a Ceph File system
>> | "share", which enables the owner to read/write any manilla share or
>> | entire file system. The vulnerability is due to a bug in the "volumes"
>> | plugin in Ceph Manager. This allows an attacker to compromise
>> | Confidentiality and Integrity of a file system. Fixed in RHCS 5.2 and
>> | Ceph 17.2.2.
>>
>> https://ceph.io/en/news/blog/2022/v17-2-2-quincy-released/
>>
>> If you fix the vulnerability please also make sure to include the
>> CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
>>
>> For further information see:
>>
>> [0] https://security-tracker.debian.org/tracker/CVE-2022-0670
>>      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0670
>>
>> Please adjust the affected versions in the BTS as needed.
>>
> 
> Hi Moritz,
> 
> If I'm not mistaking, this security hole is only in the 16.2.x series of 
> Ceph, right? I'll upgrade to 16.2.10 immediately. Please let me know 
> about Ceph in Bullseye.
> 
> Cheers,
> 
> Thomas Goirand (zigo)

Oh... now I have the problem that Ceph FTBFS with GCC 12... :/
I'll let you know when I can get this fixed.

Cheers,

Thomas Goirand (zigo)

[toc] | [prev] | [next] | [standalone]

#1111218

On 7/27/22 09:50, Thomas Goirand wrote:
> Oh... now I have the problem that Ceph FTBFS with GCC 12... :/
> I'll let you know when I can get this fixed.
> 
> Cheers,
> 
> Thomas Goirand (zigo)

Hi,

FYI, I was able to fix the build, so Ceph 16.2.10+ds was uploaded to 
Unstable, and built on all arch.

I also have the information from IRC that CVE-2022-0670 only affects 
16.2.x, and not the version in Stable or earlier. So please update the 
security tracker accordingly.

This bug can be completely closed then... (or when 16.2.10 reaches testing).

Cheers,

Thomas Goirand (zigo)

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.bugs.dist

csiph-web