RHSA-2024:0745: Moderate: Red Hat Ceph Storage 5.3 Security update

Red Hat Ceph Storage is a scalable, open, software-defined storage platform<br>that combines the most stable version of the Ceph storage system with a<br>Ceph management platform, deployment utilities, and support services.<br>These updated packages include numerous bug fixes. Space precludes<br>documenting all of these changes in this advisory. Users are directed to<br>the Red Hat Ceph Storage Release Notes for information on the most<br>significant of these changes:<br><a href="https://access.redhat.com/documentation/en-us/redhatcephstorage/5.3/html/releasenotes/index" target="blank">https://access.redhat.com/documentation/en-us/redhatcephstorage/5.3/html/releasenotes/index</a> All users of Red Hat Ceph Storage are advised to update to these packages<br>that provide various bug fixes.<br>Security Fix(es):<br><li> rgw: improperly verified POST keys (CVE-2023-43040)</li> <li> ceph: RGW crash upon misconfigured CORS rule (CVE-2023-46159)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

— Red Hat