Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption key information in log files via plaintext. Versions up to v13.2.4 are vulnerable.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Base Score: 5.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade ceph-debuginfoUpgrade python-cephfsUpgrade rbd-mirrorUpgrade python2-cryptoUpgrade cephmetrics-ansibleUpgrade ceph-mdsUpgrade libcephfs2Upgrade ceph-commonUpgrade ceph-iscsi-configUpgrade libradosstriper1Upgrade ceph-ansibleUpgrade nfs-ganesha-debuginfoUpgrade libcephfs-develUpgrade librgw-develUpgrade ceph-selinuxUpgrade librgw2Upgrade nfs-ganesha-rgwUpgrade python-crypto-debuginfoUpgrade python-rgwUpgrade nfs-ganeshaUpgrade ceph-baseUpgrade libntirpc-debuginfoUpgrade ceph-fuseUpgrade librbd-develUpgrade ceph-radosgwUpgrade nfs-ganesha-cephUpgrade librados-develUpgrade libntirpc | Mar 5, 2020 | Jan 28, 2019 |
| Debian | — | Upgrade ceph | Jul 30, 2024 | Jan 28, 2019 |
| Redhat_linux | — | Upgrade libntirpcUpgrade rbd-mirrorUpgrade ceph-baseUpgrade libcephfs-develUpgrade librados-develUpgrade ceph-commonUpgrade libcephfs2Upgrade python-cephfsUpgrade nfs-ganesha-debuginfoUpgrade ceph-debuginfoUpgrade librgw-develUpgrade python2-cryptoUpgrade ceph-iscsi-configUpgrade nfs-ganesha-rgwUpgrade ceph-fuseUpgrade nfs-ganesha-cephUpgrade librgw2Upgrade ceph-radosgwUpgrade libradosstriper1Upgrade nfs-ganeshaUpgrade python-rgwUpgrade ceph-mdsUpgrade librbd-develUpgrade ceph-ansibleUpgrade ceph-selinuxUpgrade libntirpc-debuginfoUpgrade python-crypto-debuginfoUpgrade cephmetrics-ansible | Mar 5, 2020 | Jan 28, 2019 |
| Suse | — | Upgrade python-radosUpgrade libradospp-develUpgrade python3-rgwUpgrade python-rgwUpgrade python-cephfsUpgrade rados-objclass-develUpgrade python3-rbdUpgrade libradosstriper1Upgrade python3-cephfsUpgrade libcephfs-develUpgrade librbd1Upgrade python3-ceph-argparseUpgrade librados2Upgrade ceph-commonUpgrade librbd-develUpgrade python3-ceph-commonUpgrade libcephfs2Upgrade librgw-develUpgrade python3-radosUpgrade python-rbdUpgrade librados-develUpgrade rbd-nbdUpgrade librgw2 | Feb 27, 2019 | Jan 28, 2019 |
| Ubuntu | — | Upgrade ceph-commonUpgrade ceph | Jun 25, 2019 | Jan 28, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jan 28, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub