SB2025050751 - Multiple vulnerabilities in Red Hat Ceph Storage 7
Published: May 7, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 9 secuirty vulnerabilities.
1) Input validation error (CVE-ID: CVE-2023-23934)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to insufficient validation of "nameless" cookies. A remote attacker can manipulate cookie values for an arbitrary domain.
2) Resource exhaustion (CVE-ID: CVE-2023-25577)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources when parsing multipart form data with many fields. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
3) Insufficient verification of data authenticity (CVE-ID: CVE-2023-46446)
The vulnerability allows a remote user to perform MitM attack.
The vulnerability exists due to missing verification of data authenticity. A remote user can control the remote end of an SSH client session via packet injection/removal and shell emulation.
4) Inadequate encryption strength (CVE-ID: CVE-2023-48795)
The vulnerability allows a remote attacker to perform MitM attack.
The vulnerability exists due to incorrect implementation of the SSH Binary Packet Protocol (BPP), which mishandles the handshake phase and the use of sequence numbers. A remote attacker can perform MitM attack and delete the SSH2_MSG_EXT_INFO message sent before authentication starts, allowing the attacker to disable a subset of the keystroke timing obfuscation features introduced in OpenSSH 9.5.
The vulnerability was dubbed "Terrapin attack" and it affects both client and server implementations.
5) Input validation error (CVE-ID: CVE-2024-24790)
The vulnerability allows a remote attacker to modify application behavior.
The vulnerability exists due to improper handling of IPv4-mapped IPv6 addresses in net/netip within multiple methods, e.g. IsPrivate, IsLoopback. The affected methods return false for addresses which would return true in their traditional IPv4 forms, leading to potential bypass of implemented security features.
6) Code Injection (CVE-ID: CVE-2024-34069)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation within the debugger. A remote attacker can trick the developer to interact with a domain and subdomain they control and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
7) Open redirect (CVE-ID: CVE-2024-42353)
The vulnerability allows a remote attacker to redirect victims to arbitrary URL.
The vulnerability exists due to improper sanitization of user-supplied data. A remote attacker can create a link that leads to a trusted website, however, when clicked, redirects the victim to arbitrary domain.
Successful exploitation of this vulnerability may allow a remote attacker to perform a phishing attack and steal potentially sensitive information.
8) Improper Authentication (CVE-ID: CVE-2024-47191)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to an error in pam_oath.so. A local user can overwrite the /etc/shadow file and escalate privileges on the system.
9) Improper authentication (CVE-ID: CVE-2024-48916)
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to an error when processing authentication requests within the WebTokenEngine::validate_signature() function in src/rgw/rgw_rest_sts.cc. A remote attacker can bypass authentication process and gain unauthorized access to the application.
Remediation
Install update from vendor's website.