Joshua Baergen [Wed, 17 May 2023 18:17:09 +0000 (12:17 -0600)]
CVE-2023-43040 rgw: Fix bucket validation against POST policies
It's possible that user could provide a form part as a part of a POST
object upload that uses 'bucket' as a key; in this case, it was
overriding what was being set in the validation env (which is the real
bucket being modified). The result of this is that a user could actually
upload to any bucket accessible by the specified access key by matching
the bucket in the POST policy in said POST form part.
Fix this simply by setting the bucket to the correct value after the
POST form parts are processed, ignoring the form part above if
specified.
Popen.communicate() returns a tuple (stdout, stderr), and stderr
will be of type bytes, hence the need to decode it before checking
if it's an empty string or not.
Gbp-Pq: Name CVE-2022-3650_2_ceph-crash_fix_stderr_handling.patch
If privileges cannot be dropped, log an error and exit. This commit
also catches and logs exceptions when scraping the crash path, without
which ceph-crash would just exit if it encountered an error.
Gbp-Pq: Name CVE-2022-3650_1_ceph-crash_drop_privleges_to_run_as_ceph_user_rather_than_root.patch
see also
https://www.boost.org/doc/libs/1_74_0/doc/html/boost_asio/std_executors.html#boost_asio.std_executors.polymorphic_i_o_executor
we could use `asio::any_io_executor` later on though for better
performance.
also, define CMP0093, so FindBoost reports Boost_VERSION in x.y.z
format. it is simpler to use `VERSION_GREATER_EQUAL` to compare its
version with 1.74 instead of its C macro version ("107000").
Gbp-Pq: Name cmake_define_BOOST_ASIO_USE_TS_EXECUTOR_AS_DEFAULT_for_Boost.Asio_users.patch
Kefu Chai [Fri, 28 Jun 2019 03:35:54 +0000 (11:35 +0800)]
[PATCH] os/bluestore/BlueFS: use uint64_t for `len`
change the type of parameter `len` of `BlueFS::_read_random()` from
`size_t` to `uint64_t`.
i think the type of `size_t` comes from
`rocksdb::RandomAccessFile::Read(uint64_t offset, size_t n,
rocksdb::Slice* result, char* scratch)`. and when we implement this
method, we continued using `n`'s type. but, we are using it with
`std::min()`, for instance, where the template parameter type deduction
fails if the lhs and rhs parameters' types are different. so probaly the
better solution is to use `uint64_t` directly to avoid the the cast and
specializing the template.
Signed-off-by: Kefu Chai <kchai@redhat.com>
Gbp-Pq: Name bluefs-use-uint64_t-for-len.patch
unsigned and size_t are equivalent on 32 bit architectures,
so only define the size_t based overload of advance on 64
bit architectures.
https://wiki.debian.org/ArchitectureSpecificsMemo
Bug-Ubuntu: https://launchpad.net/bugs/1756854
Bug-Ubuntu: https://launchpad.net/bugs/1766998
Forwarded: no
Last-Update: 2018-04-24
Instead of -source/-target ceph should be build with --release for OpenJDK 9
or later so that the bootclasspath is also set, as per JEP-247, otherwise it
risks incurring into binary incompatibility when run with an earlier OpenJDK.
OpenJDK 11 minimum compatibility release has been updated to 7.
Last-Update: 2018-04-24
Gbp-Pq: Name update-java-source-target-flags.patch
* CVE-2022-3650: privilege escalation from the ceph user to root. Applied
upstream patches (Closes: #1024932).
[ Bastien Roucariès ]
* CVE-2021-3979:
A key length flaw was found. An attacker can exploit the
fact that the key length is incorrectly passed in an
encryption algorithm to create a non random key,
which is weaker and can be exploited for loss of
confidentiality and integrity on encrypted disks.
* CVE-2023-43040 rgw: Fix bucket validation against POST policies
(Closes: #1053690)
* CVE-2025-52555: an unprivileged user can escalate to root
privileges in a ceph-fuse mounted CephFS by chmod 777
a directory owned by root to gain access. The result
of this is that a user could read, write and execute
to any directory owned by root as long as they chmod
777 it. This impacts confidentiality, integrity, and availability.
(Closes: #1108410)
projects / ceph.git / log