ceph ceph - vulnerabilities and exploits

(subscribe to this query)

2.1

CVSSv2

A flaw was found in Ceph-ansible v4.0.41 where it creates an /etc/ceph/iscsi-gateway.conf with insecure default permissions. This flaw allows any user on the system to read sensitive information within this file. The highest threat from this vulnerability is to confidentiality.

Ceph Ceph-ansible 4.0.41 Redhat Ceph Storage 3.0 Redhat Ceph Storage 4.0

5

CVSSv2

A path traversal flaw was found in the Ceph dashboard implemented in upstream versions v14.2.5, v14.2.6, v15.0.0 of Ceph storage and has been fixed in versions 14.2.7 and 15.1.0. An unauthenticated attacker could use this flaw to cause information disclosure on the host machine r...

Linuxfoundation Ceph 14.2.5 Linuxfoundation Ceph 14.2.6 Linuxfoundation Ceph 15.0.0 Redhat Ceph Storage 4.0

1 Github repository

2.1

CVSSv2

The admin command in ceph-deploy prior to 1.5.25 uses world-readable permissions for /etc/ceph/ceph.client.admin.keyring, which allows local users to obtain sensitive information by reading the file.

Ceph Ceph-deploy

9

CVSSv2

A flaw was found in the ceph-ansible playbook where it contained hardcoded passwords that were being used as default passwords while deploying Ceph services. Any authenticated attacker can abuse this flaw to brute-force Ceph deployments, and gain administrator access to Ceph clus...

Ceph Ceph-ansible

5

CVSSv2

A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests. An unauthenticated attacker could crash the Ceph RGW server by sending valid HTTP headers and terminating the connection, resulting in a remote denial of service for Ceph RGW clie...

Ceph Ceph -Redhat Ceph Storage 3.0 Redhat Ceph Storage 3.3 Fedoraproject Fedora 30 Fedoraproject Fedora 31

1 Github repository

NA

IBM Storage Ceph 5.3z1, 5.3z5, and 6.1z1 could allow an authenticated user on the network to cause a denial of service from RGW. IBM X-Force ID: 268906.

Ibm Storage Ceph 5.3z1 Ibm Storage Ceph 6.1z1 Ibm Storage Ceph 5.3z5

NA

A flaw was found in Ceph, relating to the URL processing on RGW backends. An attacker can exploit the URL processing by providing a null URL to crash the RGW, causing a denial of service.

Redhat Ceph Storage 3.0 Redhat Ceph Storage 4.0 Redhat Ceph Storage 5.0

2.1

CVSSv2

In Ceph, a format string flaw was found in the way libradosstriper parses input from user. A user could crash an application or service using the libradosstriper library.

Ceph Ceph -Debian Debian Linux 10.0

7.5

CVSSv2

An issue exists in Grafana up to and including 7.3.4, when integrated with Zabbix. The Zabbix password can be found in the api_jsonrpc.php HTML source code. When the user logs in and allows the user to register, one can right click to view the source code and use Ctrl-F to search...

Grafana Grafana Redhat Ceph Storage 3.0 Redhat Storage 3.0 Redhat Ceph Storage 4.0 Redhat Ceph Storage 5.0

3.6

CVSSv2

User credentials can be manipulated and stolen by Native CephFS consumers of OpenStack Manila, resulting in potential privilege escalation. An Open Stack Manila user can request access to a share to an arbitrary cephx user, including existing users. The access key is retrieved vi...

Redhat Ceph Redhat Ceph Storage 3.0 Redhat Ceph Storage 2.0 Redhat Openshift Container Platform 4.0 Redhat Ceph Storage 4.0 Redhat Openstack Platform 13.0 Fedoraproject Fedora 33

Get Started

1 2 3 4 5 6 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook