Publishing details
Changelog
ceph (17.2.5-0ubuntu0.22.10.3) kinetic-security; urgency=medium
* SECURITY UPDATE: privilege escalation via ceph crash service
- debian/patches/CVE-2022-3650-1.patch: re-add unused frame in
handler() in src/ceph-crash.in.
- debian/patches/CVE-2022-3650-2.patch: fix some flake8 issues in
src/ceph-crash.in.
- debian/patches/CVE-2022-3650-3.patch: fix stderr handling in
src/ceph-crash.in.
- debian/patches/CVE-2022-3650-4.patch: drop privleges to run as "ceph"
user, rather than root in src/ceph-crash.in.
- debian/patches/CVE-2022-3650-5.patch: chown crash files to ceph user
in qa/workunits/rados/test_crash.sh.
- debian/patches/CVE-2022-3650-6.patch: log warning if crash directory
unreadable in src/ceph-crash.in.
- CVE-2022-3650
* This also fixes CVE-2022-0670 and CVE-2022-3854 in the -security
pocket.
-- Marc Deslauriers <email address hidden> Wed, 19 Apr 2023 18:53:35 -0400
Builds
Package files