A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in clear text. This can be found by searching the mgr logs for grafana and dashboard, with passwords visible.
CVSS Details
- CVSS 3.1 Base Score: 4.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade ceph-mon-debuginfoUpgrade ceph-ansibleUpgrade python3-radosUpgrade ceph-radosgwUpgrade gperftools-libs-debuginfoUpgrade librbd-develUpgrade libcephfs-develUpgrade gperftools-debugsourceUpgrade ceph-mds-debuginfoUpgrade python-rgwUpgrade ceph-fuse-debuginfoUpgrade python3-rgwUpgrade ceph-osd-debuginfoUpgrade libradosstriper1Upgrade rbd-fuse-debuginfoUpgrade ceph-selinuxUpgrade ceph-common-debuginfoUpgrade ceph-mdsUpgrade tcmu-runnerUpgrade python3-cephfsUpgrade ceph-commonUpgrade python3-rbd-debuginfoUpgrade ceph-fuseUpgrade librgw2Upgrade python3-cephfs-debuginfoUpgrade libcephfs2Upgrade python3-rgw-debuginfoUpgrade librados-devel-debuginfoUpgrade gperftools-libsUpgrade python-cephfsUpgrade ceph-radosgw-debuginfoUpgrade libradospp-develUpgrade ceph-debugsourceUpgrade rbd-mirror-debuginfoUpgrade librados-develUpgrade librgw2-debuginfoUpgrade python3-rbdUpgrade python3-rados-debuginfoUpgrade python-ceph-argparseUpgrade ceph-test-debuginfoUpgrade python3-ceph-argparseUpgrade libradosstriper1-debuginfoUpgrade librgw-develUpgrade libcephfs2-debuginfoUpgrade ceph-mgr-debuginfoUpgrade rbd-nbdUpgrade libtcmuUpgrade rbd-mirrorUpgrade ceph-grafana-dashboardsUpgrade rbd-nbd-debuginfoUpgrade ceph-baseUpgrade ceph-base-debuginfoUpgrade ceph-debuginfo | Jun 1, 2021 | Jan 8, 2021 |
| Debian | — | Upgrade ceph | Oct 25, 2023 | Jan 8, 2021 |
| Gentoo Linux | — | Upgrade sys-cluster/ceph. | May 28, 2021 | Jan 8, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python-radosUpgrade librbd1Upgrade librados2Upgrade python-rbd | May 18, 2021 | Jan 8, 2021 |
| Redhat_linux | — | Upgrade ceph-mdsUpgrade ceph-selinuxUpgrade ceph-common-debuginfoNo solution existsUpgrade libradospp-develUpgrade python3-cephfsUpgrade python3-rbdUpgrade ceph-base-debuginfoUpgrade python-ceph-argparseUpgrade ceph-mgr-debuginfoUpgrade librgw2Upgrade ceph-radosgw-debuginfoUpgrade ceph-test-debuginfoUpgrade librbd-develUpgrade rbd-mirror-debuginfoUpgrade libradosstriper1Upgrade python3-rgw-debuginfoUpgrade python3-rgwUpgrade ceph-mon-debuginfoUpgrade ceph-baseUpgrade python3-ceph-argparseUpgrade ceph-debugsourceUpgrade python-rgwUpgrade ceph-ansibleUpgrade python3-cephfs-debuginfoUpgrade ceph-fuseUpgrade ceph-osd-debuginfoUpgrade libcephfs-develUpgrade ceph-mds-debuginfoUpgrade rbd-nbd-debuginfoUpgrade rbd-fuse-debuginfoUpgrade librados-devel-debuginfoUpgrade python-cephfsUpgrade libcephfs2Upgrade ceph-debuginfoUpgrade librados-develUpgrade libcephfs2-debuginfoUpgrade ceph-commonUpgrade python3-rados-debuginfoUpgrade libradosstriper1-debuginfoUpgrade python3-rbd-debuginfoUpgrade ceph-grafana-dashboardsUpgrade gperftools-libsUpgrade rbd-mirrorUpgrade ceph-radosgwUpgrade gperftools-libs-debuginfoUpgrade gperftools-debugsourceUpgrade libtcmuUpgrade librgw2-debuginfoUpgrade rbd-nbdUpgrade librgw-develUpgrade ceph-fuse-debuginfoUpgrade python3-radosUpgrade tcmu-runner | Apr 30, 2021 | Jan 8, 2021 |
| Suse | — | Upgrade python3-ceph-commonUpgrade ceph-osdUpgrade ceph-mdsUpgrade rbd-nbdUpgrade python3-radosUpgrade python3-cephfsUpgrade cephUpgrade ceph-mgr-diskprediction-cloudUpgrade librgw2Upgrade cephadmUpgrade rbd-mirrorUpgrade ceph-mgr-rookUpgrade rbd-fuseUpgrade rados-objclass-develUpgrade ceph-fuseUpgrade librados2Upgrade ceph-immutable-object-cacheUpgrade ceph-radosgwUpgrade ceph-mgr-cephadmUpgrade ceph-testUpgrade librbd-develUpgrade ceph-mgr-dashboardUpgrade ceph-prometheus-alertsUpgrade librgw-develUpgrade ceph-mgr-diskprediction-localUpgrade python3-rgwUpgrade libradospp-develUpgrade libcephfs2Upgrade python3-ceph-argparseUpgrade libcephfs-develUpgrade python3-rbdUpgrade librados-develUpgrade cephfs-shellUpgrade ceph-mgrUpgrade ceph-mgr-modules-coreUpgrade ceph-grafana-dashboardsUpgrade ceph-baseUpgrade ceph-commonUpgrade librbd1Upgrade ceph-mgr-k8seventsUpgrade ceph-mon | Apr 13, 2021 | Jan 8, 2021 |
| Ubuntu | — | Upgrade ceph-mgrUpgrade ceph-mgr-k8seventsUpgrade ceph-mgr-rookUpgrade ceph-mgr-dashboardUpgrade ceph-mgr-diskprediction-cloudUpgrade cephUpgrade ceph-baseUpgrade cephadmUpgrade ceph-mgr-cephadmUpgrade ceph-mgr-diskprediction-localUpgrade radosgwUpgrade ceph-mgr-modules-coreUpgrade ceph-common | Jun 25, 2021 | Jan 8, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub