A flaw was found in the ceph-ansible playbook where it contained hardcoded passwords that were being used as default passwords while deploying Ceph services. Any authenticated attacker can abuse this flaw to brute-force Ceph deployments, and gain administrator access to Ceph clusters via the Ceph dashboard to initiate read, write, and delete Ceph clusters and also modify Ceph cluster configurations. Versions before ceph-ansible 6.0.0alpha1 are affected.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade python3-defusedxmlUpgrade python-ceph-argparseUpgrade python-rgwUpgrade python3-rgwUpgrade python-xmlsec-debuginfoUpgrade python3-xmlsec-debuginfoUpgrade nfs-ganesha-vfsUpgrade python3-cephfs-debuginfoUpgrade libradospp-develUpgrade python3-rbdUpgrade nfs-ganeshaUpgrade python3-ceph-argparseUpgrade ceph-mon-debuginfoUpgrade nfs-ganesha-rados-graceUpgrade ceph-debugsourceUpgrade ceph-test-debuginfoUpgrade python3-samlUpgrade ceph-common-debuginfoUpgrade nfs-ganesha-rados-urlsUpgrade python-defusedxmlUpgrade nfs-ganesha-rgwUpgrade python-xmlsec-debugsourceUpgrade nfs-ganesha-ceph-debuginfoUpgrade ceph-baseUpgrade python3-cephfsUpgrade ceph-base-debuginfoUpgrade ceph-radosgw-debuginfoUpgrade rbd-mirror-debuginfoUpgrade ceph-selinuxUpgrade librbd-develUpgrade libradosstriper1Upgrade nfs-ganesha-debugsourceUpgrade nfs-ganesha-cephUpgrade s3cmdUpgrade python3-rgw-debuginfoUpgrade nfs-ganesha-rados-grace-debuginfoUpgrade ceph-ansibleUpgrade ceph-osd-debuginfoUpgrade python-cephfsUpgrade librgw2Upgrade ceph-fuseUpgrade ceph-mgr-debuginfoUpgrade python-xmlsecUpgrade librados-devel-debuginfoUpgrade rbd-mirrorUpgrade nfs-ganesha-rgw-debuginfoUpgrade nfs-ganesha-proxyUpgrade nfs-ganesha-debuginfoUpgrade libcephfs2Upgrade python-isodateUpgrade librados-develUpgrade python3-rados-debuginfoUpgrade nfs-ganesha-vfs-debuginfoUpgrade nfs-ganesha-selinuxUpgrade ceph-fuse-debuginfoUpgrade libradosstriper1-debuginfoUpgrade rbd-nbd-debuginfoUpgrade rbd-fuse-debuginfoUpgrade libcephfs2-debuginfoUpgrade ceph-debuginfoUpgrade python3-isodateUpgrade nfs-ganesha-proxy-debuginfoUpgrade python3-radosUpgrade python3-rbd-debuginfoUpgrade ceph-mdsUpgrade librgw2-debuginfoUpgrade ceph-radosgwUpgrade python-samlUpgrade python3-xmlsecUpgrade rbd-nbdUpgrade nfs-ganesha-rados-urls-debuginfoUpgrade librgw-develUpgrade libcephfs-develUpgrade ceph-grafana-dashboardsUpgrade ceph-commonUpgrade ceph-mds-debuginfo | Dec 11, 2020 | May 19, 2020 |
| Redhat_linux | — | Upgrade nfs-ganesha-cephUpgrade ceph-mon-debuginfoUpgrade ceph-mdsUpgrade nfs-ganesha-rgw-debuginfoUpgrade ceph-mgr-debuginfoUpgrade librgw2Upgrade python-defusedxmlUpgrade ceph-grafana-dashboardsUpgrade ceph-radosgw-debuginfoUpgrade nfs-ganesha-ceph-debuginfoUpgrade python3-defusedxmlUpgrade python3-rados-debuginfoUpgrade librados-develUpgrade python3-cephfs-debuginfoUpgrade libcephfs2-debuginfoUpgrade librgw-develUpgrade python-samlUpgrade nfs-ganesha-proxy-debuginfoUpgrade ceph-base-debuginfoUpgrade python3-radosUpgrade python-isodateUpgrade python3-ceph-argparseUpgrade python3-samlUpgrade python3-xmlsec-debuginfoUpgrade libcephfs2Upgrade rbd-mirror-debuginfoUpgrade ceph-debugsourceUpgrade python-xmlsecUpgrade python3-cephfsUpgrade rbd-nbd-debuginfoUpgrade python3-rgwUpgrade nfs-ganesha-proxyUpgrade nfs-ganesha-selinuxUpgrade ceph-test-debuginfoUpgrade nfs-ganesha-vfs-debuginfoUpgrade nfs-ganesha-rgwUpgrade rbd-fuse-debuginfoUpgrade ceph-selinuxUpgrade python3-rbdUpgrade ceph-fuse-debuginfoUpgrade nfs-ganesha-vfsUpgrade nfs-ganesha-rados-grace-debuginfoUpgrade ceph-mds-debuginfoUpgrade python-ceph-argparseUpgrade nfs-ganesha-rados-urls-debuginfoUpgrade python3-rgw-debuginfoUpgrade python3-xmlsecUpgrade rbd-mirrorUpgrade librgw2-debuginfoUpgrade python3-rbd-debuginfoUpgrade nfs-ganeshaUpgrade s3cmdUpgrade librbd-develUpgrade nfs-ganesha-rados-urlsUpgrade python-xmlsec-debugsourceUpgrade ceph-radosgwUpgrade python3-isodateUpgrade python-cephfsUpgrade ceph-osd-debuginfoUpgrade ceph-baseUpgrade librados-devel-debuginfoUpgrade ceph-debuginfoUpgrade ceph-fuseUpgrade ceph-common-debuginfoUpgrade libcephfs-develUpgrade ceph-ansibleUpgrade nfs-ganesha-debugsourceUpgrade libradosstriper1-debuginfoUpgrade nfs-ganesha-rados-graceUpgrade nfs-ganesha-debuginfoUpgrade libradospp-develUpgrade python-rgwUpgrade rbd-nbdUpgrade ceph-commonUpgrade libradosstriper1Upgrade python-xmlsec-debuginfo | Dec 11, 2020 | May 19, 2020 |
| Rocky_linux | — | Upgrade smartmontools-debugsourceUpgrade smartmontools-debuginfoUpgrade smartmontools | Mar 12, 2024 | May 28, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub