Test ID:	1.3.6.1.4.1.25623.1.1.12.2023.6063.1
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-6063-1)
Summary:	The remote host is missing an update for the 'ceph' package(s) announced via the USN-6063-1 advisory.
Description:	Summary: The remote host is missing an update for the 'ceph' package(s) announced via the USN-6063-1 advisory. Vulnerability Insight: Mark Kirkwood discovered that Ceph incorrectly handled certain key lengths. An attacker could possibly use this issue to create non-random encryption keys. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-3979) It was discovered that Ceph incorrectly handled the volumes plugin. An attacker could possibly use this issue to obtain access to any share. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2022-0670) It was discovered that Ceph incorrectly handled crash dumps. A local attacker could possibly use this issue to escalate privileges to root. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2022-3650) It was discovered that Ceph incorrectly handled URL processing on RGW backends. An attacker could possibly use this issue to cause RGW to crash, leading to a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 22.10. (CVE-2022-3854) Affected Software/OS: 'ceph' package(s) on Ubuntu 18.04, Ubuntu 20.04, Ubuntu 22.04, Ubuntu 22.10. Solution: Please install the updated package(s). CVSS Score: 9.4 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2021-3979 FEDORA-2022-d832fd2f45 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BPOK44BESMIFW6BIOGCN452AKKOIIT6Q/ https://access.redhat.com/security/cve/CVE-2021-3979 https://bugzilla.redhat.com/show_bug.cgi?id=2024788 https://github.com/ceph/ceph/commit/47c33179f9a15ae95cc1579a421be89378602656 https://github.com/ceph/ceph/pull/44765 https://tracker.ceph.com/issues/54006 https://lists.debian.org/debian-lts-announce/2023/10/msg00034.html Common Vulnerability Exposure (CVE) ID: CVE-2022-0670 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5O3XMDFZWA2FWU6GAYOVSFJPOUTXN42N/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TIRTTRG5O4YP2TNGDCDOHIHP2DM3DFBT/ https://ceph.io/en/news/blog/2022/v17-2-2-quincy-released/ Common Vulnerability Exposure (CVE) ID: CVE-2022-3650 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OEVVWT5ZFLYCVZNDJTDX7R6RY2W7JHP5/ https://security.gentoo.org/glsa/202312-10 https://seclists.org/oss-sec/2022/q4/41 Common Vulnerability Exposure (CVE) ID: CVE-2022-3854 https://bugzilla.redhat.com/show_bug.cgi?id=2139925
Copyright	Copyright (C) 2023 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.