A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in clear text. This can be found by searching the mgr logs for grafana and dashboard, with passwords visible.
CVSS Details
- CVSS 3.1 Base Score: 4.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade ceph-fuseUpgrade libradosstriper1Upgrade ceph-radosgwUpgrade ceph-selinuxUpgrade ceph-mon-debuginfoUpgrade python3-cephfs-debuginfoUpgrade ceph-ansibleUpgrade rbd-fuse-debuginfoUpgrade ceph-fuse-debuginfoUpgrade librgw2Upgrade tcmu-runnerUpgrade ceph-osd-debuginfoUpgrade python3-rgwUpgrade gperftools-debugsourceUpgrade python-rgwUpgrade ceph-mds-debuginfoUpgrade python3-cephfsUpgrade python3-rbd-debuginfoUpgrade ceph-common-debuginfoUpgrade ceph-commonUpgrade python3-radosUpgrade ceph-mdsUpgrade gperftools-libs-debuginfoUpgrade libcephfs-develUpgrade librbd-develUpgrade python3-rados-debuginfoUpgrade rbd-nbdUpgrade libradospp-develUpgrade python-cephfsUpgrade ceph-debugsourceUpgrade libcephfs2Upgrade librgw2-debuginfoUpgrade libradosstriper1-debuginfoUpgrade librados-develUpgrade gperftools-libsUpgrade libcephfs2-debuginfoUpgrade python3-ceph-argparseUpgrade rbd-mirror-debuginfoUpgrade python3-rbdUpgrade ceph-mgr-debuginfoUpgrade python3-rgw-debuginfoUpgrade librados-devel-debuginfoUpgrade ceph-radosgw-debuginfoUpgrade ceph-debuginfoUpgrade libtcmuUpgrade ceph-grafana-dashboardsUpgrade python-ceph-argparseUpgrade ceph-test-debuginfoUpgrade ceph-baseUpgrade librgw-develUpgrade ceph-base-debuginfoUpgrade rbd-nbd-debuginfoUpgrade rbd-mirror | Jun 1, 2021 | Jan 8, 2021 |
| Debian | — | Upgrade ceph | Oct 25, 2023 | Jan 8, 2021 |
| Gentoo Linux | — | Upgrade sys-cluster/ceph. | May 28, 2021 | Jan 8, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python-rbdUpgrade python-radosUpgrade librados2Upgrade librbd1 | May 18, 2021 | Jan 8, 2021 |
| Redhat_linux | — | Upgrade ceph-baseUpgrade ceph-fuseUpgrade librbd-develUpgrade librgw2Upgrade python3-cephfsUpgrade libradospp-develUpgrade python3-ceph-argparseUpgrade ceph-mon-debuginfoNo solution existsUpgrade python-rgwUpgrade python3-rgwUpgrade python3-rbdUpgrade ceph-mgr-debuginfoUpgrade ceph-base-debuginfoUpgrade ceph-debugsourceUpgrade ceph-osd-debuginfoUpgrade python-ceph-argparseUpgrade ceph-selinuxUpgrade python3-cephfs-debuginfoUpgrade ceph-ansibleUpgrade ceph-mdsUpgrade libradosstriper1Upgrade ceph-radosgw-debuginfoUpgrade python3-rgw-debuginfoUpgrade ceph-test-debuginfoUpgrade rbd-mirror-debuginfoUpgrade ceph-common-debuginfoUpgrade libcephfs2Upgrade ceph-commonUpgrade librados-develUpgrade python3-radosUpgrade librgw-develUpgrade ceph-fuse-debuginfoUpgrade python-cephfsUpgrade rbd-nbd-debuginfoUpgrade rbd-fuse-debuginfoUpgrade gperftools-libsUpgrade python3-rados-debuginfoUpgrade python3-rbd-debuginfoUpgrade ceph-mds-debuginfoUpgrade ceph-grafana-dashboardsUpgrade gperftools-debugsourceUpgrade tcmu-runnerUpgrade libradosstriper1-debuginfoUpgrade libtcmuUpgrade ceph-radosgwUpgrade librados-devel-debuginfoUpgrade rbd-nbdUpgrade libcephfs-develUpgrade gperftools-libs-debuginfoUpgrade librgw2-debuginfoUpgrade rbd-mirrorUpgrade ceph-debuginfoUpgrade libcephfs2-debuginfo | Apr 30, 2021 | Jan 8, 2021 |
| Suse | — | Upgrade ceph-monUpgrade ceph-mgr-modules-coreUpgrade ceph-mgr-diskprediction-localUpgrade librgw-develUpgrade libcephfs-develUpgrade ceph-mgrUpgrade ceph-baseUpgrade ceph-commonUpgrade ceph-grafana-dashboardsUpgrade ceph-mgr-k8seventsUpgrade python3-ceph-argparseUpgrade librados-develUpgrade python3-rbdUpgrade libcephfs2Upgrade python3-rgwUpgrade libradospp-develUpgrade librbd1Upgrade cephfs-shellUpgrade ceph-prometheus-alertsUpgrade cephUpgrade python3-radosUpgrade ceph-osdUpgrade ceph-mdsUpgrade python3-ceph-commonUpgrade ceph-mgr-diskprediction-cloudUpgrade rbd-fuseUpgrade cephadmUpgrade ceph-mgr-cephadmUpgrade ceph-mgr-rookUpgrade librgw2Upgrade ceph-testUpgrade librados2Upgrade rados-objclass-develUpgrade rbd-mirrorUpgrade ceph-radosgwUpgrade ceph-fuseUpgrade librbd-develUpgrade ceph-mgr-dashboardUpgrade rbd-nbdUpgrade python3-cephfsUpgrade ceph-immutable-object-cache | Apr 13, 2021 | Jan 8, 2021 |
| Ubuntu | — | Upgrade ceph-mgr-k8seventsUpgrade ceph-mgr-rookUpgrade ceph-mgrUpgrade ceph-mgr-dashboardUpgrade ceph-mgr-diskprediction-cloudUpgrade cephadmUpgrade ceph-mgr-cephadmUpgrade ceph-mgr-modules-coreUpgrade ceph-commonUpgrade radosgwUpgrade cephUpgrade ceph-mgr-diskprediction-localUpgrade ceph-base | Jun 25, 2021 | Jan 8, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub