Bug 1372446 (CVE-2016-7031)

Summary:	CVE-2016-7031 ceph: RGW permits bucket listing when authenticated_users=read
Product:	[Other] Security Response	Reporter:	Siddharth Sharma <sisharma>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aortega, apevec, ayoung, ceph-eng-bugs, chrisw, cvsbot-xmlrpc, jschluet, kbasil, lars, lhh, lpeer, markmc, mburns, rbryant, rhos-maint, sclewis, sisharma, slong, srevivo, tdecacqu
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in Ceph RGW code which allows an anonymous user to list contents of RGW bucket by bypassing ACL which should only allow authenticated users to list contents of bucket.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-09-29 14:35:37 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1372572
Bug Blocks:	1372443

Description Siddharth Sharma 2016-09-01 18:22:03 UTC

Description of problem:

An anonymous S3 user may be able to (incorrectly) list the contents of a bucket which has an authenticated_users=read ACL.


Version-Release number of selected component (if applicable):
1.3.x


Additional info:
This issue corresponds to upstream tracker issue
http://tracker.ceph.com/issues/13207

Fixed on master in
https://github.com/ceph/ceph/pull/6057

Comment 4 errata-xmlrpc 2016-09-29 13:00:51 UTC

This issue has been addressed in the following products:

  Red Hat Ceph Storage 1.3 for RHEL 7

Via RHSA-2016:1972 https://rhn.redhat.com/errata/RHSA-2016-1972.html

Comment 5 errata-xmlrpc 2016-09-29 13:14:50 UTC

This issue has been addressed in the following products:

  Red Hat Ceph Storage 1.3 for Ubuntu

Via RHSA-2016:1973 https://rhn.redhat.com/errata/RHSA-2016-1973.html