Veille CVE

Recherche « Red Hat Ceph Storage 8 »

11 CVE

Critique 0 Élevée 6 Moyenne 5 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Red Hat Ceph Storage 8 » ✕
  1. CVE-2026-18495 6.1 Moyenne

    Red Hat Hardened Images · Red Hat Ceph Storage 4 · Red Hat Ceph Storage 6 · Red Hat Ceph Storage 7

    A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the `tiff2pdf` utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit `StripByteCounts` value to be truncated to a 32-bit integer. This leads to an undersized memory allocation and a subsequent out-of-bounds memory copy, resulting in a crash and severe memory corruption.

  2. CVE-2026-87874 8.1 Élevée

    Red Hat Ceph Storage 5 · Red Hat Ceph Storage 9 · Red Hat OpenStack Platform 17.1 · Red Hat OpenStack Platform 18.0

    A flaw was found in the memcached cache plugin of the community.general Ansible collection. Although its documentation states that records are stored in JSON format, the plugin performs no explicit serialization and relies on python-memcached, which pickles values on write and unpickles them on read. Because memcached is unauthenticated and cache keys are predictable, an attacker able to reach a network-exposed or shared memcached instance can write a crafted pickle payload that is deserialized and executed on the Ansible controller when the poisoned fact cache is next read, leading to remote code execution.

  3. CVE-2026-87872 6.8 Moyenne

    Red Hat Ceph Storage 5 · Red Hat Ceph Storage 9 · Red Hat OpenStack Platform 17.1 · Red Hat OpenStack Platform 18.0

    A flaw was found in the OCAPI modules (ocapi_command, ocapi_info) of the community.general Ansible collection. The shared OCAPI request helper disables TLS certificate validation on every request and the modules expose no parameter to re-enable it, while sending HTTP Basic-Auth credentials to an https endpoint. An attacker positioned on the network path between the Ansible controller and the OCAPI-managed storage/enclosure device can present any certificate, intercept the session, capture the credentials, and tamper with responses.

  4. CVE-2025-30156 8.9 Élevée

    ceph

    Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the CephX authentication protocol encrypts tickets with AES-128-CBC in an unauthenticated mode that uses a hard-coded initialization vector and no message authentication, allowing an attacker to forge credentials and gain cluster-wide access. Because the ciphertext is malleable and the monitor will encrypt attacker-chosen entity names, an attacker holding one low-privilege key and able to observe CephX traffic can use the monitor as an encryption oracle and splice ciphertext blocks into valid tickets for privileged entities such as Manager, MDS, and OSD. The same lack of authentication also lets an attacker with CephX permissions escalate privileges by flipping a single bit in a service ticket to set its allow_all field to true. This issue is fixed in versions 20.2.4 and 19.2.6.

  5. CVE-2026-80158 5.5 Moyenne

    Red Hat Ceph Storage 5 · Red Hat Ceph Storage 9 · Red Hat OpenStack Platform 17.1 · Red Hat OpenStack Platform 18.0

    A flaw was found in the ipa_getkeytab module of the community.general Ansible collection. The module's bind_pw parameter, used to supply the LDAP simple-bind password when retrieving a Kerberos keytab, is not declared with no_log, unlike the sibling password parameter in the same module. As a consequence, the supplied IPA/LDAP bind password is recorded in cleartext in the managed host's system journal/syslog (the module's "Invoked with" record), is included in the module's return values and verbose (-v) output, and is displayed in Automation Controller / AWX job output. The password is additionally passed on the command line to the ipa-getkeytab helper (as --bindpw <value>), exposing it in the process list to local users while the command runs. An attacker able to read these logs, job output, or the process table can obtain the directory bind credential, potentially compromising the accounts and objects that credential can access.

  6. CVE-2026-58224 6.5 Moyenne

    Red Hat Ceph Storage 9.2 · Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 7

    A flaw was found in Samba's CTDB, the clustered database service used by Samba. Insufficient integrity validation of received CTDB protocol packets allows malformed packets containing invalid field lengths, improperly terminated strings, or inconsistent packet sizes to be processed without adequate bounds checking. A remote attacker with access to the CTDB private network may trigger a denial of service through process crashes or excessive memory consumption and, in limited cases, disclose adjacent memory contents.

  7. CVE-2026-41567 7.2 Élevée

    moby/v2/daemon · moby Docker Engine · docker/daemon · Red Hat Multicluster Global Hub 1.4.5

    Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from the container's filesystem rather than the host's due to incorrect ordering of operations. A malicious container image containing a trojanized decompression binary can achieve arbitrary code execution with full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using authorization plugins to restrict access to the `PUT /containers/{id}/archive` endpoint, and avoiding piping compressed archives into containers created from untrusted images

  8. CVE-2026-44289 7.5 Élevée

    protobufjs protobuf.js · Red Hat Ansible Automation Platform 2.2 · Red Hat OpenShift AI 3.4 · Red Hat OpenShift Pipelines

    protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message fields. A crafted protobuf binary payload could cause the JavaScript call stack to be exhausted during decoding. This vulnerability is fixed in 7.5.6 and 8.0.2.

  9. CVE-2026-41602 7.5 Élevée

    Apache Software Foundation Apache Thrift · Red Hat Multicluster Global Hub 1.3.4 · Red Hat Multicluster Global Hub 1.4.5 · Red Hat Multicluster Global Hub 1.6.5

    Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

  10. CVE-2025-48431 7.5 Élevée

    Apache Software Foundation Apache Thrift · Red Hat Cryostat 4 on RHEL 9 · Red Hat Advanced Cluster Management for Kubernetes 2.14 · Red Hat Advanced Cluster Management for Kubernetes 2.15

    Mismatched Memory Management Routines vulnerability in Apache Thrift c_glib language bindings. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue. Description: Specially crafted requests can crash an c_glib-based Thrift server with a clean but fatal "free(): invalid pointer" error message.

  11. CVE-2024-11831 5.4 Moyenne

    Red Hat Advanced Cluster Security 4.4 · Red Hat Advanced Cluster Security 4.5 · Red Hat Ceph Storage 7.1 · Red Hat Ceph Storage 8.1

    A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code could be executed when deserialized by a web browser, causing Cross-site scripting (XSS) attacks. This issue is critical in environments where serialized data is sent to web clients, potentially compromising the security of the website or web application using this package.