Red Hat Ceph Storage 5
Monthly
Remote code execution via unsafe Python pickle deserialization in the community.general Ansible collection's memcached fact cache plugin gives unauthenticated network-adjacent attackers full control of the Ansible controller. Despite documenting JSON as its storage format, the plugin delegates serialization entirely to python-memcached, which transparently pickles Python objects on write and unpickles them on read - a format that executes arbitrary Python code during deserialization. Because memcached has no native authentication and Ansible fact cache keys are derived from predictable hostnames, any attacker who can write to the target memcached instance can inject a malicious payload that executes when the controller next reads cached facts. No public exploit or CISA KEV entry has been identified at time of analysis.
Unconditional TLS certificate validation disabling in the OCAPI modules (ocapi_command, ocapi_info) of the community.general Ansible collection exposes HTTP Basic-Auth credentials to interception and permits response tampering against any managed OCAPI storage or enclosure device. Because the shared request helper disables certificate validation on every call with no parameter to re-enable it, a network-adjacent attacker performing a MITM attack can present any certificate, silently capture credentials, and inject falsified device responses back to the Ansible controller. Red Hat bundles the affected collection in Ceph Storage 5 and 9 and OpenStack Platform 17.1 and 18.0; no public exploit has been identified at time of analysis.
Remote code execution via unsafe Python pickle deserialization in the community.general Ansible collection's memcached fact cache plugin gives unauthenticated network-adjacent attackers full control of the Ansible controller. Despite documenting JSON as its storage format, the plugin delegates serialization entirely to python-memcached, which transparently pickles Python objects on write and unpickles them on read - a format that executes arbitrary Python code during deserialization. Because memcached has no native authentication and Ansible fact cache keys are derived from predictable hostnames, any attacker who can write to the target memcached instance can inject a malicious payload that executes when the controller next reads cached facts. No public exploit or CISA KEV entry has been identified at time of analysis.
Unconditional TLS certificate validation disabling in the OCAPI modules (ocapi_command, ocapi_info) of the community.general Ansible collection exposes HTTP Basic-Auth credentials to interception and permits response tampering against any managed OCAPI storage or enclosure device. Because the shared request helper disables certificate validation on every call with no parameter to re-enable it, a network-adjacent attacker performing a MITM attack can present any certificate, silently capture credentials, and inject falsified device responses back to the Ansible controller. Red Hat bundles the affected collection in Ceph Storage 5 and 9 and OpenStack Platform 17.1 and 18.0; no public exploit has been identified at time of analysis.