Sage Mctaggart

A flaw was found in JSS, which is a memory leak that requires non-standard configuration. This issue can be exploited as a low-effort Denial of Service (DoS) vector if configured in a specific way, such as repeatedly hitting the login page.

A flaw was found in OpenStack, where multiple components show plain-text passwords in /var/log/messages during the OpenStack overcloud update run, leading to a disclosure of sensitive information problem.

A flaw exists that allows the addition of arbitrary lines into a container's `/etc/passwd` file by using a specially crafted environment variable containing newlines. This can be used to bypass admission validation of the username or UID. This issue may impact the confidentiality, integrity, and availability of protected information.

The issue is related to the lack of HTTP Strict Transport Security (HSTS) in Openshift, which may allow man-in-the-middle (MITM) attacks. HSTS is a security feature that helps prevent MITM attacks by ensuring that communications between a client and a server are encrypted. Without HSTS, an attacker could potentially intercept and modify traffic.

The issue is related to the absence of the X-FRAME-OPTIONS header in response headers, which helps prevent Clickjacking attacks. Without this header, some browsers may interpret the results incorrectly, allowing clickjacking attacks to occur.

A flaw in Openshift allows an attacker to exploit the DNS search policy, affecting confidentiality and availability. This occurs when a pod has a DNSPolicy of "ClusterFirst" and may incorrectly resolve the hostname based on a service provided, enabling the attacker to supply an incorrect name.

A flaw was found in Buildah, where incorrect absolute path traversal may disclose the local path and the lowest subdirectory, resulting in an impact to confidentiality.

A vulnerability was found in buildah, where incorrect following of symlinks while reading .containerignore and .dockerignore files results in information disclosure. This issue affects buildah as part of Podman.

A flaw was found in Keystone, where there is a time lag of up to one hour in the default configuration between when the security policy says a token should be revoked and when it is actually revoked. This could allow a remote administrator to secretly maintain access for longer than expected. The issue is related to the revocation of token access, potentially allowing an authenticated remote attacker to obtain access despite efforts to remove it.

A flaw was found in Ceph, relating to the URL processing on RGW backends. An attacker can exploit the URL processing by providing a null URL to crash the RGW, causing a denial of service.

The issue is related to the ef100 update stats function in the drivers/net/ethernet/sfc/ef100 nic.c module of the Linux kernel, which lacks a check of the return value of `kmalloc()`. This can lead to a pointer dereference error. Exploitation of this issue may allow an attacker to cause a denial of service or elevate their privileges.

A key length flaw was found in the encryption algorithm of Red Hat Ceph Storage. This flaw allows an attacker to create a non-random key, which is weaker and can be exploited for loss of confidentiality and integrity on encrypted disks. The vulnerability is related to the incorrect passing of the key length in the encryption algorithm. An attacker can exploit this flaw to gain access to confidential data and compromise their integrity.

Name of the Vulnerable Software and Affected Versions: ceph versions prior to 16.y.z Description: A flaw was found in ceph where it stores mgr module passwords in clear text. This issue can be identified by searching the mgr logs for `grafana` and `dashboard`, with passwords visible. The highest threat from this issue is to confidentiality. Recommendations: For versions prior to 16.y.z, consider restricting access to the mgr logs to minimize the risk of password exposure until a patch is available. As a temporary workaround, avoid using the `mgr` module for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

A flaw in Ceph-ansible allows any user on the system to read sensitive information within the /etc/ceph/iscsi-gateway.conf file due to insecure default permissions. The highest threat from this issue is to confidentiality.

A flaw was found in the Cephx authentication protocol, where it does not verify Ceph clients correctly and is then vulnerable to replay attacks in Nautilus. This flaw allows an attacker with access to the Ceph cluster network to authenticate with the Ceph service via a packet sniffer and perform actions allowed by the Ceph service. The highest threat from this vulnerability is to confidentiality, integrity, and system availability.

A flaw was found in the Red Hat Ceph Storage RadosGW related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made. This issue is also related to insufficient input validation, which may allow a remote attacker to impact data integrity.

The issue is related to a flaw in the authentication procedure of the ceph storage network, which can be exploited by a remote attacker to access confidential data, compromise data integrity, and cause a denial of service. The vulnerability allows key reuse when the monitor handles `CEPHX GET AUTH SESSION KEY` requests, enabling an attacker to request a `global id` previously associated with another user. This poses a significant threat to data confidentiality, integrity, and system availability.

The issue is related to incorrect handling of a URL that ends with two slashes, which can cause the system to crash, resulting in a denial of service. This can be exploited by a remote attacker, posing the greatest threat to system availability.