A flaw was found in the ceph-ansible playbook where it contained hardcoded passwords that were being used as default passwords while deploying Ceph services. Any authenticated attacker can abuse this flaw to brute-force Ceph deployments, and gain administrator access to Ceph clusters via the Ceph dashboard to initiate read, write, and delete Ceph clusters and also modify Ceph cluster configurations. Versions before ceph-ansible 6.0.0alpha1 are affected.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade ceph-osd-debuginfoUpgrade librbd-develUpgrade rbd-mirror-debuginfoUpgrade librgw2Upgrade ceph-fuseUpgrade nfs-ganesha-cephUpgrade ceph-selinuxUpgrade nfs-ganesha-debugsourceUpgrade python3-rgwUpgrade python3-cephfsUpgrade python-rgwUpgrade python3-ceph-argparseUpgrade python3-defusedxmlUpgrade ceph-baseUpgrade libradospp-develUpgrade ceph-mgr-debuginfoUpgrade ceph-mon-debuginfoUpgrade python-ceph-argparseUpgrade python-xmlsec-debuginfoUpgrade python3-rbdUpgrade python-cephfsUpgrade ceph-base-debuginfoUpgrade nfs-ganesha-rados-urlsUpgrade python3-samlUpgrade nfs-ganesha-ceph-debuginfoUpgrade ceph-test-debuginfoUpgrade python3-xmlsec-debuginfoUpgrade ceph-debugsourceUpgrade nfs-ganesha-rados-graceUpgrade python3-cephfs-debuginfoUpgrade nfs-ganesha-rados-grace-debuginfoUpgrade python-defusedxmlUpgrade python-xmlsec-debugsourceUpgrade nfs-ganeshaUpgrade ceph-ansibleUpgrade nfs-ganesha-vfsUpgrade ceph-common-debuginfoUpgrade nfs-ganesha-rgwUpgrade ceph-radosgw-debuginfoUpgrade libradosstriper1Upgrade python3-rgw-debuginfoUpgrade s3cmdUpgrade libcephfs-develUpgrade ceph-grafana-dashboardsUpgrade rbd-mirrorUpgrade nfs-ganesha-rgw-debuginfoUpgrade nfs-ganesha-rados-urls-debuginfoUpgrade nfs-ganesha-debuginfoUpgrade libcephfs2Upgrade python3-isodateUpgrade ceph-debuginfoUpgrade libradosstriper1-debuginfoUpgrade libcephfs2-debuginfoUpgrade nfs-ganesha-proxy-debuginfoUpgrade python3-radosUpgrade nfs-ganesha-vfs-debuginfoUpgrade ceph-mdsUpgrade librgw-develUpgrade ceph-commonUpgrade librgw2-debuginfoUpgrade ceph-radosgwUpgrade nfs-ganesha-proxyUpgrade python-samlUpgrade nfs-ganesha-selinuxUpgrade rbd-nbd-debuginfoUpgrade rbd-fuse-debuginfoUpgrade python-xmlsecUpgrade librados-devel-debuginfoUpgrade ceph-fuse-debuginfoUpgrade rbd-nbdUpgrade python3-xmlsecUpgrade python3-rbd-debuginfoUpgrade python-isodateUpgrade librados-develUpgrade python3-rados-debuginfoUpgrade ceph-mds-debuginfo | Dec 11, 2020 | May 19, 2020 |
| Redhat_linux | — | Upgrade ceph-mdsUpgrade ceph-grafana-dashboardsUpgrade nfs-ganesha-cephUpgrade python3-rados-debuginfoUpgrade ceph-mon-debuginfoUpgrade nfs-ganesha-proxy-debuginfoUpgrade librgw2Upgrade nfs-ganesha-vfs-debuginfoUpgrade nfs-ganesha-rgw-debuginfoUpgrade python3-rgwUpgrade python-samlUpgrade python3-defusedxmlUpgrade rbd-mirror-debuginfoUpgrade python3-ceph-argparseUpgrade python3-cephfs-debuginfoUpgrade python3-radosUpgrade ceph-base-debuginfoUpgrade python3-xmlsec-debuginfoUpgrade ceph-debugsourceUpgrade rbd-nbd-debuginfoUpgrade ceph-radosgw-debuginfoUpgrade python-xmlsecUpgrade python3-samlUpgrade librados-develUpgrade python-defusedxmlUpgrade ceph-mgr-debuginfoUpgrade python-isodateUpgrade ceph-test-debuginfoUpgrade libcephfs2Upgrade nfs-ganesha-selinuxUpgrade nfs-ganesha-proxyUpgrade nfs-ganesha-ceph-debuginfoUpgrade librgw-develUpgrade nfs-ganesha-rgwUpgrade libcephfs2-debuginfoUpgrade python3-cephfsUpgrade rbd-fuse-debuginfoUpgrade nfs-ganesha-rados-urls-debuginfoUpgrade python-rgwUpgrade python-cephfsUpgrade ceph-commonUpgrade libradosstriper1Upgrade librbd-develUpgrade rbd-nbdUpgrade python-xmlsec-debugsourceUpgrade nfs-ganesha-rados-urlsUpgrade nfs-ganeshaUpgrade librgw2-debuginfoUpgrade s3cmdUpgrade python3-xmlsecUpgrade ceph-fuseUpgrade python-xmlsec-debuginfoUpgrade nfs-ganesha-debuginfoUpgrade python-ceph-argparseUpgrade ceph-baseUpgrade ceph-osd-debuginfoUpgrade librados-devel-debuginfoUpgrade python3-rbdUpgrade nfs-ganesha-debugsourceUpgrade ceph-fuse-debuginfoUpgrade libradosstriper1-debuginfoUpgrade python3-rbd-debuginfoUpgrade python3-rgw-debuginfoUpgrade rbd-mirrorUpgrade nfs-ganesha-vfsUpgrade nfs-ganesha-rados-graceUpgrade ceph-debuginfoUpgrade libradospp-develUpgrade libcephfs-develUpgrade nfs-ganesha-rados-grace-debuginfoUpgrade ceph-mds-debuginfoUpgrade ceph-common-debuginfoUpgrade ceph-selinuxUpgrade ceph-ansibleUpgrade ceph-radosgwUpgrade python3-isodate | Dec 11, 2020 | May 19, 2020 |
| Rocky_linux | — | Upgrade smartmontoolsUpgrade smartmontools-debuginfoUpgrade smartmontools-debugsource | Mar 12, 2024 | May 28, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub