A flaw was found in Openstack manilla owning a Ceph File system "share", which enables the owner to read/write any manilla share or entire file system. The vulnerability is due to a bug in the "volumes" plugin in Ceph Manager. This allows an attacker to compromise Confidentiality and Integrity of a file system. Fixed in RHCS 5.2 and Ceph 17.2.2.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ceph: cephx protocol is vulnerable to replay attack (CVE-2018-1128)

  - ceph: user/tenant can obtain access (read/write) to any share (CVE-2022-0670)

  - A flaw was found in the way signature calculation was handled by cephx authentication protocol. An     attacker having access to ceph cluster network who is able to alter the message payload was able to bypass     signature checks done by cephx protocol. Ceph branches master, mimic, luminous and jewel are believed to     be vulnerable. (CVE-2018-1129)

  - A flaw was found in the Red Hat Ceph Storage RGW in versions before 14.2.21. When processing a GET Request     for a swift URL that ends with two slashes it can cause the rgw to crash, resulting in a denial of     service. The greatest threat to the system is of availability. (CVE-2021-3531)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 22.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6063-1 advisory.

  - A key length flaw was found in Red Hat Ceph Storage. An attacker can exploit the fact that the key length     is incorrectly passed in an encryption algorithm to create a non random key, which is weaker and can be     exploited for loss of confidentiality and integrity on encrypted disks. (CVE-2021-3979)

  - A flaw was found in Openstack manilla owning a Ceph File system share, which enables the owner to     read/write any manilla share or entire file system. The vulnerability is due to a bug in the volumes     plugin in Ceph Manager. This allows an attacker to compromise Confidentiality and Integrity of a file     system. Fixed in RHCS 5.2 and Ceph 17.2.2. (CVE-2022-0670)

  - A privilege escalation flaw was found in Ceph. Ceph-crash.service allows a local attacker to escalate     privileges to root in the form of a crash dump, and dump privileged information. (CVE-2022-3650)

  - A flaw was found in Ceph, relating to the URL processing on RGW backends. An attacker can exploit the URL     processing by providing a null URL to crash the RGW, causing a denial of service. (CVE-2022-3854)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:1581-1 advisory.

  - A flaw was found in Openstack manilla owning a Ceph File system share, which enables the owner to     read/write any manilla share or entire file system. The vulnerability is due to a bug in the volumes     plugin in Ceph Manager. This allows an attacker to compromise Confidentiality and Integrity of a file     system. Fixed in RHCS 5.2 and Ceph 17.2.2. (CVE-2022-0670)

  - A privilege escalation flaw was found in Ceph. Ceph-crash.service allows a local attacker to escalate     privileges to root in the form of a crash dump, and dump privileged information. (CVE-2022-3650)

  - A flaw was found in Ceph, relating to the URL processing on RGW backends. An attacker can exploit the URL     processing by providing a null URL to crash the RGW, causing a denial of service. (CVE-2022-3854)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:1580-1 advisory.

  - A flaw was found in Openstack manilla owning a Ceph File system share, which enables the owner to     read/write any manilla share or entire file system. The vulnerability is due to a bug in the volumes     plugin in Ceph Manager. This allows an attacker to compromise Confidentiality and Integrity of a file     system. Fixed in RHCS 5.2 and Ceph 17.2.2. (CVE-2022-0670)

  - A privilege escalation flaw was found in Ceph. Ceph-crash.service allows a local attacker to escalate     privileges to root in the form of a crash dump, and dump privileged information. (CVE-2022-3650)

  - A flaw was found in Ceph, relating to the URL processing on RGW backends. An attacker can exploit the URL     processing by providing a null URL to crash the RGW, causing a denial of service. (CVE-2022-3854)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:5997 advisory.

  - ceph: user/tenant can obtain access (read/write) to any share (CVE-2022-0670)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
196244	RHEL 7 : ceph (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
175537	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Ceph vulnerabilities (USN-6063-1)	Nessus	Ubuntu Local Security Checks	critical
173611	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : ceph (SUSE-SU-2023:1581-1)	Nessus	SuSE Local Security Checks	critical
173448	SUSE SLES15 Security Update : ceph (SUSE-SU-2023:1580-1)	Nessus	SuSE Local Security Checks	critical
163972	RHEL 8 / 9 : Red Hat Ceph Storage Security, Bug Fix, and Enhancement Update (Moderate) (RHSA-2022:5997)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2022-0670

critical

Tenable Plugins

critical

critical

critical

critical

critical