A flaw was found in the way civetweb frontend was handling requests for ceph RGW server with SSL enabled. An unauthenticated attacker could create multiple connections to ceph RADOS gateway to exhaust file descriptors for ceph-radosgw service resulting in a remote denial of service.

This update for ceph fixes the following issues :

Security issues fixed :

CVE-2019-3821: civetweb: fix file descriptor leak (bsc#1125080)

CVE-2018-16889: rgw: sanitize customer encryption keys from log output in v4 auth (bsc#1121567)

Non-security issues fixed: install grafana dashboards world readable (bsc#1136110)

upgrade results in cluster outage (bsc#1132396)

ceph status reports 'HEALTH_WARN 3 monitors have not enabled msgr2' (bsc#1124957)

Dashboard: Opening tcmu-runner perf counters results in a 404 (bsc#1135388)

RadosGW stopped expiring objects (bsc#1133139)

Ceph does not recover when rebuilding every OSD (bsc#1133461)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4035-1 advisory.

    It was discovered that Ceph incorrectly handled read only permissions. An authenticated attacker could use     this issue to obtain dm-crypt encryption keys. This issue only affected Ubuntu 16.04 LTS. (CVE-2018-14662)

    It was discovered that Ceph incorrectly handled certain OMAPs holding bucket indices. An authenticated     attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04     LTS. (CVE-2018-16846)

    It was discovered that Ceph incorrectly sanitized certain debug logs. A local attacker could possibly use     this issue to obtain encryption key information. This issue was only addressed in Ubuntu 18.10 and Ubuntu     19.04. (CVE-2018-16889)

    It was discovered that Ceph incorrectly handled certain civetweb requests. A remote attacker could     possibly use this issue to consume resources, leading to a denial of service. This issue only affected     Ubuntu 18.10 and Ubuntu 19.04. (CVE-2019-3821)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
127765	SUSE SLED15 / SLES15 Security Update : ceph (SUSE-SU-2019:2049-1)	Nessus	SuSE Local Security Checks	Local	high
126255	Ubuntu 16.04 LTS : Ceph vulnerabilities (USN-4035-1)	Nessus	Ubuntu Local Security Checks	Local	high

Detections

Analytics

CVE-2019-3821

high

Tenable Plugins

high

high