Publishing details

Changelog

ceph (10.2.11-0ubuntu0.16.04.3) xenial-security; urgency=medium

  * SECURITY UPDATE: XSS attacks
    - debian/patches/CVE-2020-1760-1.patch: reject unauthenticated
      response-header actions in src/rgw/rgw_rest_s3.cc.
    - debian/patches/CVE-2020-1760-2.patch: change EPERM to
      ERR_INVALID_REQUEST in src/rgw/rgw_rest_s3.cc.
    - debian/patches/CVE-2020-1760-3.patch: reject control characters in
      response-header actions in src/rgw/rgw_rest_s3.cc.
    - CVE-2020-1760
  * SECURITY UPDATE: HTTP header injection
    - debian/patches/CVE-2020-10753.patch: sanitize newlines in
      src/rgw/rgw_cors.cc.
    - CVE-2020-10753

 -- Marc Deslauriers <email address hidden>  Wed, 09 Sep 2020 08:57:28 -0400

Available diffs

Builds

Built packages

Package files