RHSA-2026:83548HighCVSS 8.7

Red Hat Security Advisory: Red Hat Ceph Storage

Published
October 15, 2026
Last Modified
October 15, 2026

🔗 CVE IDs covered (18)

CVE-2025-7783 →CVE-2025-30156 →CVE-2025-64756 →CVE-2019-10790 →CVE-2023-25153 →CVE-2023-46159 →CVE-2024-37890 →CVE-2025-50182 →CVE-2026-50152 →CVE-2024-5206 →CVE-2024-11831 →CVE-2025-47914 →CVE-2025-50181 →CVE-2025-64718 →CVE-2023-28155 →CVE-2024-47866 →CVE-2025-58181 →CVE-2025-59436 →

📋 Description

CVE-2019-10790 — taffy: taffydb: Internal Property Tampering CVE-2023-25153 — containerd: OCI image importer memory exhaustion CVE-2023-28155 — request: bypass of SSRF mitigations when following a cross-protocol redirect CVE-2023-46159 — ceph: RGW crash upon misconfigured CORS rule CVE-2024-5206 — scikit-learn: Possible sensitive data leak CVE-2024-11831 — npm-serialize-javascript: Cross-site Scripting (XSS) in serialize-javascript CVE-2024-37890 — nodejs-ws: denial of service when handling a request with many HTTP headers CVE-2024-47866 — rgw: RGW DoS attack with empty HTTP header in S3 object copy CVE-2025-7783 — form-data: Unsafe random function in form-data CVE-2025-30156 — kernel: ceph: kernel: Ceph: exploit of hardcoded IVECs, in a misuse of AES, resulting in authentication bypass CVE-2025-47914 — golang.org/x/crypto/ssh/agent: SSH Agent servers: Denial of Service due to malformed messages CVE-2025-50181 — urllib3: urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation CVE-2025-50182 — urllib3: urllib3 does not control redirects in browsers and Node.js CVE-2025-58181 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via unbounded memory consumption in GSSAPI authentication CVE-2025-59436 — ip: Node ip SSRF CVE-2025-64718 — js-yaml: js-yaml prototype pollution in merge CVE-2025-64756 — glob: glob: Command Injection Vulnerability via Malicious Filenames CVE-2026-50152 — ceph: ceph: MON subscription handler exposes config-key store to low-privilege CephX users

🎯 Affected products19

  • Red Hat Ceph Storage 7.1
  • registry.redhat.io/rhceph/grafana-rhel9@sha256:017c64392c1a85ba5726cd2af371903a0e4de67e4c0b421a3f35cdf2f74e825b_s390x as a component of Red Hat Ceph Storage 7.1
  • registry.redhat.io/rhceph/grafana-rhel9@sha256:7ddde3e05da2669f50aa06bc3431c0db1a81b0a31dde4e0a03eeebd6b2957b49_ppc64le as a component of Red Hat Ceph Storage 7.1
  • registry.redhat.io/rhceph/grafana-rhel9@sha256:9855523cf71d68a3f6d04db0d7cd57dd811549db83cea9b48b340dbc8cecfeb5_amd64 as a component of Red Hat Ceph Storage 7.1
  • registry.redhat.io/rhceph/keepalived-rhel9@sha256:4a2e971e0c6abe92b23ec9738045428991d07aa2addb7545bf5dfaa0b09b43bd_ppc64le as a component of Red Hat Ceph Storage 7.1
  • registry.redhat.io/rhceph/keepalived-rhel9@sha256:532555a28cb1076f5a802c239888290e49d25bb20247e21fc33820a5382cf215_s390x as a component of Red Hat Ceph Storage 7.1
  • registry.redhat.io/rhceph/keepalived-rhel9@sha256:f493172ce07a31e3c04a11d7c37908fb03e7e599170405ea1838ddfc186209e7_amd64 as a component of Red Hat Ceph Storage 7.1
  • registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:2095d6e6b73d50fcdbacc6d5e5ba8b0d5fcdfea807705730d2715a1eff2bf15d_amd64 as a component of Red Hat Ceph Storage 7.1
  • registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:6efa0ffa477dfbf006f96eb7d0d7936f78d135046a33649552a94ddca0861d91_ppc64le as a component of Red Hat Ceph Storage 7.1
  • registry.redhat.io/rhceph/rhceph-7-rhel9@sha256:7609dc4e02f90e9c89d17115bd38f8b3edf9bca32f175260478f9030d6768cdc_s390x as a component of Red Hat Ceph Storage 7.1
  • registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:79282e7ddb26960c70987a984bb71901e78c8cfbd2b58d567260086d326935df_amd64 as a component of Red Hat Ceph Storage 7.1
  • registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:99978e522614cd3e65593c41b80589ba9d0d1e8df5398ac65087922a76cb63b3_ppc64le as a component of Red Hat Ceph Storage 7.1
  • registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:c889df6f36876ed697ed65a3e4b70c9496288f8ccd148481022f3ba544f099b6_s390x as a component of Red Hat Ceph Storage 7.1
  • registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:0da5db7378e70afc3231c603a7627dd2d7fb4f9c4607f3e34a79f2b3274b5a26_amd64 as a component of Red Hat Ceph Storage 7.1
  • registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:6a7590ca91e50888726791d5b386bdd29bc582f8379d58f3727464d8e89ddd4d_s390x as a component of Red Hat Ceph Storage 7.1
  • registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:ce8179276493d3845620d31e74989f0411a0aa18d045d02de515e7d0ac8a3076_ppc64le as a component of Red Hat Ceph Storage 7.1
  • registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:0e608f9523ab775a4988a2dbf01a152b148b4a5c2bd48c79d9d70f9ad2c9a196_ppc64le as a component of Red Hat Ceph Storage 7.1
  • registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:881786268dad82c7cd82b94d34f6004213417ffd681727be34e3d878bf802a88_s390x as a component of Red Hat Ceph Storage 7.1
  • registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:c5a1d0b24dc05c48c5087f7143e251d7f91e10c3ff7900136f8fec9ede6207eb_amd64 as a component of Red Hat Ceph Storage 7.1

✅ Remediation

The container images provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the "podman pull" command. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: The issue can be mitigated by reducing the maximum allowed length of the request headers using the --max-http-header-size=size or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. The issue can be mitigated also by seting server.maxHeadersCount to 0. Workaround: To mitigate this issue, Red Hat recommends isolating the Ceph messenger protocol to dedicated internal networks with strict access controls, limiting exposure to potential attackers. Administrators should audit and minimize the number of CephX client credentials in circulation and enforce strong credential management to reduce the risk of low-privilege key compromise. Where possible, deploy msgr2 with on-wire encryption to reduce passive sniffing exposure. It is strongly advised to apply vendor-supplied patches as soon as they are released, upgrade to fixed Ceph versions (Tentacle 20.2.4 or later), and rotate all CephX keys to the new AES-256-CTS-HMAC-SHA384-192 cipher type, prioritizing server-side keys. Workaround: To mitigate this issue, avoid using the `glob` command-line interface with the `-c` or `--cmd` option when processing filenames from untrusted sources. If programmatic use of `glob` is necessary, ensure that filenames are thoroughly sanitized before being passed to commands executed with shell interpretation enabled. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (22)