Advisories » MGASA-2021-0126

Updated ceph packages fix security vulnerabilities

Publication date: 12 Mar 2021
Modification date: 12 Mar 2021
Type: security
Affected Mageia releases : 8
CVE: CVE-2020-25678 , CVE-2020-27839

Description

A flaw was found in Ceph where Ceph stores mgr module passwords in clear text.
This issue can be found by searching the mgr logs for Grafana and dashboard
with passwords visible. The highest threat from this vulnerability is to
confidentiality (CVE-2020-25678).

A flaw was found in ceph-dashboard. The JSON Web Token (JWT) used for user
authentication is stored by the frontend application in the browser’s
localStorage which is potentially vulnerable to attackers via XSS attacks. The
highest threat from this vulnerability is to data confidentiality and
integrity (CVE-2020-27839).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=28538
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/OQTBKVXVYP7GPQNZ5VASOIJHMLK7727M/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25678
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27839

SRPMS

8/core

• ceph-15.2.9-1.mga8