SUSE-SU-2021:0023-1

HIGH7.3

Security update for ceph

Published Jan 5, 2021

Modified 5 years ago

Fix available

Details

Description of the patch:

This update for ceph fixes the following issues:

Security issues fixed:

CVE-2020-27781: Fixed a privilege escalation via the ceph_volume_client Python interface (bsc#1179802 bsc#1180155).

Non-security issues fixed:

Fixes an issue when check in legacy collection reaches end. (bsc#1179139)
Fixes an issue when storage service stops. (bsc#1178837)
Fix for failing test run due to missing module 'six'. (bsc#1179452)
Provide a different name for the fallback allocator in bluestore. (bsc#1180118)

Affected Packages(16 packages)

ceph-common

SUSE Enterprise Storage 6SUSE Linux Enterprise Desktop 15 SP1SUSE Linux Enterprise High Performance Computing 15 SP1SUSE Linux Enterprise Module for Basesystem 15 SP1SUSE Linux Enterprise Server 15 SP1

Fixed in:

14.2.16.402+g7d47dbaf4d-3.57.1

libcephfs-devel

SUSE Enterprise Storage 6SUSE Linux Enterprise Desktop 15 SP1SUSE Linux Enterprise High Performance Computing 15 SP1SUSE Linux Enterprise Module for Basesystem 15 SP1SUSE Linux Enterprise Server 15 SP1

Fixed in:

14.2.16.402+g7d47dbaf4d-3.57.1

libcephfs2

SUSE Enterprise Storage 6SUSE Linux Enterprise Desktop 15 SP1SUSE Linux Enterprise High Performance Computing 15 SP1SUSE Linux Enterprise Module for Basesystem 15 SP1SUSE Linux Enterprise Server 15 SP1

Fixed in:

14.2.16.402+g7d47dbaf4d-3.57.1

librados-devel

SUSE Enterprise Storage 6SUSE Linux Enterprise Desktop 15 SP1SUSE Linux Enterprise High Performance Computing 15 SP1SUSE Linux Enterprise Module for Basesystem 15 SP1SUSE Linux Enterprise Server 15 SP1

Fixed in:

14.2.16.402+g7d47dbaf4d-3.57.1

librados2

SUSE Enterprise Storage 6SUSE Linux Enterprise Desktop 15 SP1SUSE Linux Enterprise High Performance Computing 15 SP1SUSE Linux Enterprise Module for Basesystem 15 SP1SUSE Linux Enterprise Server 15 SP1

Fixed in:

14.2.16.402+g7d47dbaf4d-3.57.1

libradospp-devel

SUSE Enterprise Storage 6SUSE Linux Enterprise Desktop 15 SP1SUSE Linux Enterprise High Performance Computing 15 SP1SUSE Linux Enterprise Module for Basesystem 15 SP1SUSE Linux Enterprise Server 15 SP1

Fixed in:

14.2.16.402+g7d47dbaf4d-3.57.1

librbd-devel

SUSE Enterprise Storage 6SUSE Linux Enterprise Desktop 15 SP1SUSE Linux Enterprise High Performance Computing 15 SP1SUSE Linux Enterprise Module for Basesystem 15 SP1SUSE Linux Enterprise Server 15 SP1

Fixed in:

14.2.16.402+g7d47dbaf4d-3.57.1

librbd1

SUSE Enterprise Storage 6SUSE Linux Enterprise Desktop 15 SP1SUSE Linux Enterprise High Performance Computing 15 SP1SUSE Linux Enterprise Module for Basesystem 15 SP1SUSE Linux Enterprise Server 15 SP1

Fixed in:

14.2.16.402+g7d47dbaf4d-3.57.1

librgw-devel

SUSE Enterprise Storage 6SUSE Linux Enterprise Desktop 15 SP1SUSE Linux Enterprise High Performance Computing 15 SP1SUSE Linux Enterprise Module for Basesystem 15 SP1SUSE Linux Enterprise Server 15 SP1

Fixed in:

14.2.16.402+g7d47dbaf4d-3.57.1

librgw2

SUSE Enterprise Storage 6SUSE Linux Enterprise Desktop 15 SP1SUSE Linux Enterprise High Performance Computing 15 SP1SUSE Linux Enterprise Module for Basesystem 15 SP1SUSE Linux Enterprise Server 15 SP1

Fixed in:

14.2.16.402+g7d47dbaf4d-3.57.1

References

https://bugzilla.suse.com/1178837

https://bugzilla.suse.com/1179139

https://bugzilla.suse.com/1179452

https://bugzilla.suse.com/1179802

https://bugzilla.suse.com/1180118

https://bugzilla.suse.com/1180155

https://lists.suse.com/pipermail/sle-security-updates/2021-January/008148.html

https://www.suse.com/security/cve/CVE-2020-27781/

https://www.suse.com/support/security/rating/

https://www.suse.com/support/update/announcement/2021/suse-su-20210023-1/

CVSS Analysis

CVSS v3.1

7.3

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

LowAC:L

Privileges Required

LowPR:L

User Interaction

NoneUI:N

Scope

Scope

ChangedS:C

Impact

Confidentiality

LowC:L

Integrity

HighI:H

Availability

NoneA:N

7.3/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N

Upstream

Ecosystems(9)

SUSE Enterprise Storage 6 SUSE Linux Enterprise Desktop 15 SP1 SUSE Linux Enterprise High Performance Computing 15 SP1 SUSE Linux Enterprise Module for Basesystem 15 SP1 SUSE Linux Enterprise Server 15 SP1

Timeline

PublishedJan 5, 2021

ModifiedJan 5, 2021

SUSE-SU-2021:0023-1 | Mondoo Vulnerability Intelligence