CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-3650 – Ceph: ceph-crash.service allows local ceph user to root exploit
https://notcve.org/view.php?id=CVE-2022-3650
A privilege escalation flaw was found in Ceph. Ceph-crash.service allows a local attacker to escalate privileges to root in the form of a crash dump, and dump privileged information. Se encontró una falla de escalada de privilegios en Ceph. Ceph-crash.service permite a un atacante local escalar privilegios a root en forma de volcado de memoria y volcar información privilegiada. A privilege escalation flaw was found in Ceph. • https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OEVVWT5ZFLYCVZNDJTDX7R6RY2W7JHP5 https://seclists.org/oss-sec/2022/q4/41 https://security.gentoo.org/glsa/202312-10 https://access.redhat.com/security/cve/CVE-2022-3650 https://bugzilla.redhat.com/show_bug.cgi?id=2136909 • CWE-842: Placement of User into Incorrect Group •
CVSS: 9.1EPSS: 0%CPEs: 6EXPL: 0CVE-2022-0670 – ceph: user/tenant can obtain access (read/write) to any share
https://notcve.org/view.php?id=CVE-2022-0670
A flaw was found in Openstack manilla owning a Ceph File system "share", which enables the owner to read/write any manilla share or entire file system. The vulnerability is due to a bug in the "volumes" plugin in Ceph Manager. This allows an attacker to compromise Confidentiality and Integrity of a file system. Fixed in RHCS 5.2 and Ceph 17.2.2. Se ha encontrado un fallo en Openstack manilla que posee un "share" del sistema de archivos Ceph, que permite al propietario leer/escribir cualquier manilla compartido o todo el sistema de archivos. • https://ceph.io/en/news/blog/2022/v17-2-2-quincy-released https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5O3XMDFZWA2FWU6GAYOVSFJPOUTXN42N https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TIRTTRG5O4YP2TNGDCDOHIHP2DM3DFBT https://access.redhat.com/security/cve/CVE-2022-0670 https://bugzilla.redhat.com/show_bug.cgi?id=2050728 • CWE-863: Incorrect Authorization •