Bug 1739292 (CVE-2019-10222)
| Summary: | CVE-2019-10222 ceph: Unauthenticated clients can crash ceph RGW configured with beast as frontend | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Pedro Sampaio <psampaio> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | branto, danmick, david, dbecker, fedora, fleite, gfidente, i, jdurgin, jjoyce, josef, jschluet, kbasil, kkeithle, lhh, loic, lpeer, mburns, ramkrsna, sclewis, security-response-team, sisharma, slinaber, srangach, steve, tchandra, yjog |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests. An unauthenticated attacker could crash the Ceph RGW server by sending valid HTTP headers and terminating the connection, resulting in a remote denial of service for Ceph RGW clients.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-08-28 19:07:24 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1739515, 1746506 | ||
| Bug Blocks: | 1739293 | ||
|
Description
Pedro Sampaio
2019-08-09 01:12:25 UTC
Statement: Red Hat OpenStack Platform 13 included some Ceph components at release for in order to support ppc64le. The version provided in the OpenStack repositories is outdated and customers are expected to be using versions provided in Ceph repositories now. Additionally, only the client side and libraries were included which are not affected by this vulnerability. External References: https://tracker.ceph.com/issues/40018 Acknowledgments: Name: Abhishek Lekshmanan (SUSE Software Solutions Germany) Patch: https://github.com/ceph/ceph/pull/29967 https://github.com/ceph/ceph/pull/29967/commits/caa653196856ecdf50519a9a33195d5c4e3372af Mitigation: To mitigate this issue either of the following options can be applied to system: Mitigation 1: 1. By default system will use /etc/init.d/ceph-radosgw stop this service by ~]# /etc/init.d/ceph-radosgw stop 2. Create systemd service, and change command line parameters according to the environment where Ceph radosgw is running. ~]# cat /usr/lib/systemd/system/ceph-rgw.service [Unit] Description=Ceph RGW daemon [Service] Type=forking ExecStart=/bin/radosgw -n client.rgw.$(HOSTNAME REDACTED) Restart=on-abnormal RestartSec=1s [Install] WantedBy=multi-user.target 3. Run systemd service 'ceph-rgw.service' Caveat: It still takes +1-2 sec to get service back online. After applying above mentioned mitigation, the malicious IP can be blocked by a firewall rule if there are continuous attempts to launch remote denial of service. This mitigation is of limited use if the attack is launched from multiple IPs. It is recommended to limit the exposure of ceph RGW server to known clients. OR Mitigation 2: use 'civetweb' as HTTP frontend with ceph RGW. Created ceph tracking bugs for this issue: Affects: fedora-all [bug 1746506] This issue has been addressed in the following products: Red Hat Ceph Storage 3.3 for Ubuntu 16.04 Via RHSA-2019:2577 https://access.redhat.com/errata/RHSA-2019:2577 This issue has been addressed in the following products: Red Hat Ceph Storage 3 for Red Hat Enterprise Linux 7 Via RHSA-2019:2579 https://access.redhat.com/errata/RHSA-2019:2579 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-10222 |