CVE-2020-10736: High severity linuxfoundation Ceph vulnerability
An authorization bypass vulnerability was found in Ceph versions 15.2.0 before 15.2.2, where the ceph-mon and ceph-mgr daemons do not properly restrict access, resulting in gaining access to unauthorized resources. This flaw allows an authenticated client to modify the configuration and possibly conduct further attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/cephto a version that resolves this vulnerability.Fixed in 14.2.21-1Fixed in 16.2.11+ds-2Fixed in 18.2.4+ds-7 - Upgrade
Upgrade
alpine/cephto a version that resolves this vulnerability.Fixed in 15.2.6-r0 - Upgrade
Upgrade
alpine/ceph16to a version that resolves this vulnerability.Fixed in 15.2.6-r0 - Upgrade
Upgrade
Cephto a version that resolves this vulnerability.Fixed in 15.2.2
Event History
Frequently Asked Questions
What is CVE-2020-10736?
CVE-2020-10736 is an authorization bypass vulnerability found in Ceph versions 15.2.0 before 15.2.2.
Which components are affected by CVE-2020-10736?
The ceph-mon and ceph-mgr daemons are affected by CVE-2020-10736.
How can an attacker exploit CVE-2020-10736?
An authenticated client can exploit CVE-2020-10736 to gain access to unauthorized resources and modify the configuration.
What is the severity of CVE-2020-10736?
CVE-2020-10736 has a severity value of 8, considered high.
How can I fix CVE-2020-10736?
Upgrading Ceph to version 15.2.2 or later will fix CVE-2020-10736.