A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in clear text. This can be found by searching the mgr logs for grafana and dashboard, with passwords visible.
CVSS Details
- CVSS 3.1 Base Score: 4.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade ceph-baseUpgrade rbd-mirrorUpgrade ceph-base-debuginfoUpgrade librgw-develUpgrade ceph-debuginfoUpgrade python-cephfsUpgrade gperftools-libsUpgrade ceph-grafana-dashboardsUpgrade rbd-nbd-debuginfoUpgrade libradospp-develUpgrade libtcmuUpgrade rbd-nbdUpgrade librgw2-debuginfoUpgrade ceph-radosgw-debuginfoUpgrade librados-develUpgrade rbd-mirror-debuginfoUpgrade ceph-mgr-debuginfoUpgrade python3-rados-debuginfoUpgrade libradosstriper1-debuginfoUpgrade python3-ceph-argparseUpgrade libcephfs2-debuginfoUpgrade python3-rgw-debuginfoUpgrade python-ceph-argparseUpgrade librados-devel-debuginfoUpgrade python3-rbdUpgrade ceph-debugsourceUpgrade libcephfs2Upgrade ceph-test-debuginfoUpgrade python3-cephfsUpgrade ceph-radosgwUpgrade ceph-mon-debuginfoUpgrade rbd-fuse-debuginfoUpgrade ceph-commonUpgrade ceph-mdsUpgrade ceph-osd-debuginfoUpgrade ceph-fuse-debuginfoUpgrade python3-rgwUpgrade gperftools-libs-debuginfoUpgrade librbd-develUpgrade libcephfs-develUpgrade gperftools-debugsourceUpgrade ceph-mds-debuginfoUpgrade ceph-ansibleUpgrade python3-radosUpgrade python-rgwUpgrade python3-cephfs-debuginfoUpgrade librgw2Upgrade libradosstriper1Upgrade python3-rbd-debuginfoUpgrade ceph-fuseUpgrade ceph-selinuxUpgrade ceph-common-debuginfoUpgrade tcmu-runner | Jun 1, 2021 | Jan 8, 2021 |
| Debian | — | Upgrade ceph | Oct 25, 2023 | Jan 8, 2021 |
| Gentoo Linux | — | Upgrade sys-cluster/ceph. | May 28, 2021 | Jan 8, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python-radosUpgrade librados2Upgrade python-rbdUpgrade librbd1 | May 18, 2021 | Jan 8, 2021 |
| Redhat_linux | — | Upgrade python3-rbd-debuginfoUpgrade gperftools-libsUpgrade ceph-grafana-dashboardsUpgrade libradosstriper1-debuginfoUpgrade rbd-nbd-debuginfoUpgrade rbd-fuse-debuginfoUpgrade ceph-mds-debuginfoUpgrade libcephfs-develUpgrade python-cephfsUpgrade gperftools-debugsourceUpgrade librgw2-debuginfoUpgrade librados-develUpgrade libcephfs2-debuginfoUpgrade rbd-nbdUpgrade gperftools-libs-debuginfoUpgrade librados-devel-debuginfoUpgrade librgw-develUpgrade ceph-fuse-debuginfoUpgrade libcephfs2Upgrade python3-radosUpgrade tcmu-runnerUpgrade python3-rados-debuginfoUpgrade ceph-debuginfoUpgrade ceph-commonUpgrade rbd-mirrorUpgrade ceph-radosgwUpgrade libtcmuUpgrade python3-cephfsUpgrade ceph-mgr-debuginfoUpgrade python3-cephfs-debuginfoUpgrade ceph-debugsourceUpgrade ceph-test-debuginfoUpgrade libradospp-develUpgrade ceph-base-debuginfoUpgrade python-rgwUpgrade python3-rbdUpgrade ceph-mdsUpgrade python3-rgwUpgrade ceph-selinuxUpgrade ceph-common-debuginfoUpgrade ceph-fuseUpgrade ceph-ansibleUpgrade ceph-osd-debuginfoUpgrade ceph-baseUpgrade python3-rgw-debuginfoUpgrade ceph-mon-debuginfoNo solution existsUpgrade python-ceph-argparseUpgrade python3-ceph-argparseUpgrade librbd-develUpgrade ceph-radosgw-debuginfoUpgrade rbd-mirror-debuginfoUpgrade libradosstriper1Upgrade librgw2 | Apr 30, 2021 | Jan 8, 2021 |
| Suse | — | Upgrade cephadmUpgrade librbd-develUpgrade ceph-fuseUpgrade ceph-osdUpgrade ceph-mgr-dashboardUpgrade python3-radosUpgrade python3-cephfsUpgrade ceph-mgr-diskprediction-cloudUpgrade rbd-mirrorUpgrade rbd-nbdUpgrade ceph-radosgwUpgrade ceph-testUpgrade librgw2Upgrade ceph-mdsUpgrade ceph-immutable-object-cacheUpgrade cephUpgrade ceph-mgr-rookUpgrade rados-objclass-develUpgrade ceph-mgr-cephadmUpgrade librados2Upgrade rbd-fuseUpgrade python3-ceph-commonUpgrade libradospp-develUpgrade libcephfs2Upgrade python3-ceph-argparseUpgrade ceph-commonUpgrade ceph-mgr-diskprediction-localUpgrade python3-rgwUpgrade ceph-mgr-k8seventsUpgrade libcephfs-develUpgrade librgw-develUpgrade ceph-prometheus-alertsUpgrade ceph-monUpgrade cephfs-shellUpgrade librados-develUpgrade python3-rbdUpgrade ceph-grafana-dashboardsUpgrade ceph-mgrUpgrade ceph-baseUpgrade ceph-mgr-modules-coreUpgrade librbd1 | Apr 13, 2021 | Jan 8, 2021 |
| Ubuntu | — | Upgrade ceph-commonUpgrade ceph-mgr-cephadmUpgrade cephadmUpgrade ceph-baseUpgrade radosgwUpgrade ceph-mgr-modules-coreUpgrade ceph-mgr-diskprediction-localUpgrade cephUpgrade ceph-mgr-dashboardUpgrade ceph-mgr-k8seventsUpgrade ceph-mgrUpgrade ceph-mgr-diskprediction-cloudUpgrade ceph-mgr-rook | Jun 25, 2021 | Jan 8, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub