CVE-2016-7031
Fixed in a distro release EPSS 2%
The RGW code in Ceph before 10.0.1, when authenticated-read ACL is applied to a bucket, allows remote attackers to list the bucket contents via a URL.
Products: ceph_project ceph, redhat ceph_storage
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | ceph | 10.2.5-1 |
| Debian 13 | ceph | 10.2.5-1 |
| Debian 14 | ceph | 10.2.5-1 |
| Red Hat ceph storage 1.3 | calamari-server | 0:1.3.3-2.el7cp |
| Red Hat ceph storage 1.3 | ceph | 1:0.94.9-3.el7cp |
| Red Hat ceph storage 1.3 | ceph-common | 1:0.94.9-3.el7cp |
| Red Hat ceph storage 1.3 | ceph-debuginfo | 1:0.94.9-3.el7cp |
| Red Hat ceph storage 1.3 | ceph-deploy | 0:1.5.36-1.el7cp |
| Red Hat ceph storage 1.3 | ceph-mon | 1:0.94.9-3.el7cp |
| Red Hat ceph storage 1.3 | ceph-osd | 1:0.94.9-3.el7cp |
| Red Hat ceph storage 1.3 | ceph-radosgw | 1:0.94.9-3.el7cp |
| Red Hat ceph storage 1.3 | ceph-selinux | 1:0.94.9-3.el7cp |
| Red Hat ceph storage 1.3 | ceph-test | 1:0.94.9-3.el7cp |
| Red Hat ceph storage 1.3 | librados2 | 1:0.94.9-3.el7cp |
| Red Hat ceph storage 1.3 | librados2-devel | 1:0.94.9-3.el7cp |
| Red Hat ceph storage 1.3 | librbd1 | 1:0.94.9-3.el7cp |
| Red Hat ceph storage 1.3 | librbd1-devel | 1:0.94.9-3.el7cp |
| Red Hat ceph storage 1.3 | python-rados | 1:0.94.9-3.el7cp |
| Red Hat ceph storage 1.3 | python-rbd | 1:0.94.9-3.el7cp |
| Red Hat ceph storage 1.3 | radosgw-agent | 0:1.2.7-1.el7cp |
| Ubuntu 14.04 LTS | ceph | 0.80.11-0ubuntu1.14.04.3 |