A flaw was found in Red Hat Ceph Storage 4, in the Dashboard component. In response to CVE-2020-27839, the JWT token was moved from localStorage to an httpOnly cookie. However, token cookies are used in the body of the HTTP response for the documentation, which again makes it available to XSS.The greatest threat to the system is for confidentiality, integrity, and availability.
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "ceph" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "ceph-base" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "ceph-base-dbgsym" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "ceph-common" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "ceph-common-dbgsym" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "ceph-fuse" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "ceph-fuse-dbgsym" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "ceph-mds" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "ceph-mds-dbgsym" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "ceph-mgr" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "ceph-mgr-dbgsym" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "ceph-mon" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "ceph-mon-dbgsym" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "ceph-osd" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "ceph-osd-dbgsym" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "ceph-resource-agents" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "ceph-test" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "ceph-test-dbgsym" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "libcephfs-dev" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "libcephfs-java" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "libcephfs-jni" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "libcephfs-jni-dbgsym" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "libcephfs2" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "libcephfs2-dbgsym" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "librados-dev" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "librados-dev-dbgsym" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "librados2" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "librados2-dbgsym" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "libradosstriper-dev" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "libradosstriper1" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "libradosstriper1-dbgsym" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "librbd-dev" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "librbd1" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "librbd1-dbgsym" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "librgw-dev" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "librgw2" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "librgw2-dbgsym" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "python-ceph" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "python-cephfs" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "python-cephfs-dbgsym" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "python-rados" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "python-rados-dbgsym" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "python-rbd" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "python-rbd-dbgsym" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "python-rgw" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "python-rgw-dbgsym" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "python3-ceph-argparse" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "python3-cephfs" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "python3-cephfs-dbgsym" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "python3-rados" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "python3-rados-dbgsym" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "python3-rbd" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "python3-rbd-dbgsym" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "python3-rgw" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "python3-rgw-dbgsym" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "rados-objclass-dev" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "radosgw" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "radosgw-dbgsym" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "rbd-fuse" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "rbd-fuse-dbgsym" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "rbd-mirror" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "rbd-mirror-dbgsym" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "rbd-nbd" }, { "binary_version": "12.2.13-0ubuntu0.18.04.8", "binary_name": "rbd-nbd-dbgsym" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "ceph" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "ceph-base" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "ceph-base-dbgsym" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "ceph-common" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "ceph-common-dbgsym" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "ceph-fuse" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "ceph-fuse-dbgsym" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "ceph-immutable-object-cache" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "ceph-immutable-object-cache-dbgsym" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "ceph-mds" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "ceph-mds-dbgsym" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "ceph-mgr" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "ceph-mgr-cephadm" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "ceph-mgr-dashboard" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "ceph-mgr-dbgsym" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "ceph-mgr-diskprediction-cloud" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "ceph-mgr-diskprediction-local" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "ceph-mgr-k8sevents" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "ceph-mgr-modules-core" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "ceph-mgr-rook" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "ceph-mon" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "ceph-mon-dbgsym" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "ceph-osd" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "ceph-osd-dbgsym" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "ceph-resource-agents" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "cephadm" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "cephfs-shell" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "libcephfs-dev" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "libcephfs-java" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "libcephfs-jni" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "libcephfs-jni-dbgsym" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "libcephfs2" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "libcephfs2-dbgsym" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "librados-dev" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "librados-dev-dbgsym" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "librados2" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "librados2-dbgsym" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "libradospp-dev" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "libradosstriper-dev" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "libradosstriper1" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "libradosstriper1-dbgsym" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "librbd-dev" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "librbd1" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "librbd1-dbgsym" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "librgw-dev" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "librgw2" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "librgw2-dbgsym" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "python3-ceph" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "python3-ceph-argparse" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "python3-ceph-common" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "python3-cephfs" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "python3-cephfs-dbgsym" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "python3-rados" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "python3-rados-dbgsym" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "python3-rbd" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "python3-rbd-dbgsym" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "python3-rgw" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "python3-rgw-dbgsym" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "rados-objclass-dev" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "radosgw" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "radosgw-dbgsym" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "rbd-fuse" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "rbd-fuse-dbgsym" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "rbd-mirror" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "rbd-mirror-dbgsym" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "rbd-nbd" }, { "binary_version": "15.2.12-0ubuntu0.20.04.1", "binary_name": "rbd-nbd-dbgsym" } ] }