A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in clear text. This can be found by searching the mgr logs for grafana and dashboard, with passwords visible.
CVSS Details
- CVSS 3.1 Base Score: 4.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade librgw-develUpgrade python-ceph-argparseUpgrade rbd-mirrorUpgrade rbd-nbd-debuginfoUpgrade ceph-grafana-dashboardsUpgrade ceph-baseUpgrade libtcmuUpgrade ceph-base-debuginfoUpgrade rbd-mirror-debuginfoUpgrade ceph-debugsourceUpgrade ceph-radosgw-debuginfoUpgrade libradospp-develUpgrade libradosstriper1-debuginfoUpgrade ceph-test-debuginfoUpgrade rbd-nbdUpgrade python3-rbdUpgrade python3-rgw-debuginfoUpgrade librgw2-debuginfoUpgrade libcephfs2Upgrade gperftools-libsUpgrade libcephfs2-debuginfoUpgrade librados-devel-debuginfoUpgrade librados-develUpgrade ceph-mgr-debuginfoUpgrade python3-ceph-argparseUpgrade python-cephfsUpgrade ceph-debuginfoUpgrade python3-rados-debuginfoUpgrade ceph-fuseUpgrade python3-rbd-debuginfoUpgrade ceph-radosgwUpgrade ceph-mon-debuginfoUpgrade tcmu-runnerUpgrade python3-cephfsUpgrade python3-cephfs-debuginfoUpgrade librgw2Upgrade ceph-ansibleUpgrade ceph-commonUpgrade ceph-mdsUpgrade gperftools-libs-debuginfoUpgrade ceph-mds-debuginfoUpgrade libcephfs-develUpgrade ceph-fuse-debuginfoUpgrade python3-rgwUpgrade python3-radosUpgrade python-rgwUpgrade librbd-develUpgrade gperftools-debugsourceUpgrade ceph-osd-debuginfoUpgrade rbd-fuse-debuginfoUpgrade ceph-selinuxUpgrade ceph-common-debuginfoUpgrade libradosstriper1 | Jun 1, 2021 | Jan 8, 2021 |
| Debian | — | Upgrade ceph | Oct 25, 2023 | Jan 8, 2021 |
| Gentoo Linux | — | Upgrade sys-cluster/ceph. | May 28, 2021 | Jan 8, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade librbd1Upgrade python-radosUpgrade librados2Upgrade python-rbd | May 18, 2021 | Jan 8, 2021 |
| Redhat_linux | — | Upgrade librados-devel-debuginfoUpgrade libtcmuUpgrade gperftools-debugsourceUpgrade librgw2-debuginfoUpgrade gperftools-libs-debuginfoUpgrade libcephfs-develUpgrade libcephfs2Upgrade rbd-mirrorUpgrade ceph-mds-debuginfoUpgrade libradosstriper1-debuginfoUpgrade rbd-fuse-debuginfoUpgrade python-cephfsUpgrade rbd-nbd-debuginfoUpgrade ceph-radosgwUpgrade python3-rados-debuginfoUpgrade tcmu-runnerUpgrade librados-develUpgrade libcephfs2-debuginfoUpgrade python3-radosUpgrade ceph-debuginfoUpgrade ceph-grafana-dashboardsUpgrade gperftools-libsUpgrade ceph-commonUpgrade rbd-nbdUpgrade python3-rbd-debuginfoUpgrade ceph-fuse-debuginfoUpgrade librgw-develUpgrade python-rgwUpgrade ceph-common-debuginfoUpgrade ceph-selinuxNo solution existsUpgrade ceph-base-debuginfoUpgrade python3-ceph-argparseUpgrade python3-rbdUpgrade rbd-mirror-debuginfoUpgrade python3-cephfsUpgrade librgw2Upgrade ceph-ansibleUpgrade ceph-test-debuginfoUpgrade librbd-develUpgrade ceph-osd-debuginfoUpgrade ceph-radosgw-debuginfoUpgrade libradospp-develUpgrade libradosstriper1Upgrade python-ceph-argparseUpgrade ceph-mgr-debuginfoUpgrade ceph-fuseUpgrade python3-rgwUpgrade python3-rgw-debuginfoUpgrade ceph-baseUpgrade ceph-mon-debuginfoUpgrade python3-cephfs-debuginfoUpgrade ceph-debugsourceUpgrade ceph-mds | Apr 30, 2021 | Jan 8, 2021 |
| Suse | — | Upgrade python3-rbdUpgrade cephfs-shellUpgrade librgw-develUpgrade ceph-mgr-diskprediction-localUpgrade ceph-mgr-modules-coreUpgrade python3-rgwUpgrade libcephfs-develUpgrade librbd1Upgrade libradospp-develUpgrade librados-develUpgrade ceph-grafana-dashboardsUpgrade libcephfs2Upgrade ceph-commonUpgrade ceph-mgrUpgrade python3-ceph-argparseUpgrade ceph-baseUpgrade ceph-prometheus-alertsUpgrade ceph-mgr-k8seventsUpgrade ceph-monUpgrade ceph-testUpgrade ceph-mgr-rookUpgrade rbd-fuseUpgrade rbd-nbdUpgrade python3-ceph-commonUpgrade cephUpgrade ceph-mdsUpgrade ceph-immutable-object-cacheUpgrade python3-cephfsUpgrade cephadmUpgrade ceph-mgr-diskprediction-cloudUpgrade ceph-osdUpgrade librados2Upgrade python3-radosUpgrade librgw2Upgrade ceph-mgr-cephadmUpgrade librbd-develUpgrade ceph-mgr-dashboardUpgrade ceph-radosgwUpgrade ceph-fuseUpgrade rbd-mirrorUpgrade rados-objclass-devel | Apr 13, 2021 | Jan 8, 2021 |
| Ubuntu | — | Upgrade ceph-commonUpgrade cephadmUpgrade cephUpgrade ceph-mgr-modules-coreUpgrade ceph-mgr-diskprediction-localUpgrade radosgwUpgrade ceph-mgr-cephadmUpgrade ceph-baseUpgrade ceph-mgr-rookUpgrade ceph-mgrUpgrade ceph-mgr-diskprediction-cloudUpgrade ceph-mgr-dashboardUpgrade ceph-mgr-k8sevents | Jun 25, 2021 | Jan 8, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub