Published: 15/01/2019 Updated: 19/04/2022

CVSS v2 Base Score: 2.7 | Impact Score: 2.9 | Exploitability Score: 5.1

CVSS v3 Base Score: 5.7 | Impact Score: 3.6 | Exploitability Score: 2.1

VMScore: 240

Vector: AV:A/AC:L/Au:S/C:P/I:N/A:N

It was found Ceph versions prior to 13.2.4 that authenticated ceph users with read only permissions could steal dm-crypt encryption keys used in ceph disk encryption.

Vulnerable Product	Search on Vulmon	Subscribe to Product
redhat ceph
debian debian linux 8.0
debian debian linux 9.0
opensuse leap 15.0
redhat ceph storage 2.0
redhat ceph storage 3.0
redhat enterprise linux server 7.0
canonical ubuntu linux 16.04
canonical ubuntu linux 18.10
canonical ubuntu linux 19.04

Several security issues were fixed in Ceph ...

Synopsis Moderate: Red Hat Ceph Storage 33 security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Topic An update is now available for Red Hat Ceph Storage 33 on Ubuntu 1604Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulne ...

Synopsis Moderate: Red Hat Ceph Storage 33 security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Topic An update is now available for Red Hat Ceph Storage 33 on Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Moderate ...

Debian Bug report logs - #921947 CVE-2018-16846 Package: src:ceph; Maintainer for src:ceph is Ceph Maintainers <ceph-maintainers@listscephcom>; Reported by: Moritz Muehlenhoff <jmm@debianorg> Date: Sun, 10 Feb 2019 13:15:02 UTC Severity: important Tags: security, upstream Found in version ceph/12210+dfsg1-1 Fix ...

Debian Bug report logs - #921948 CVE-2018-14662 Package: src:ceph; Maintainer for src:ceph is Ceph Maintainers <ceph-maintainers@listscephcom>; Reported by: Moritz Muehlenhoff <jmm@debianorg> Date: Sun, 10 Feb 2019 13:18:02 UTC Severity: important Tags: security, upstream Found in version ceph/12210+dfsg1-1 Fix ...

Debian Bug report logs - #918969 ceph: CVE-2018-16889: debug logging for v4 auth does not sanitize encryption keys Package: src:ceph; Maintainer for src:ceph is Ceph Maintainers <ceph-maintainers@listscephcom>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Fri, 11 Jan 2019 08:06:02 UTC Severity: impor ...

It was found that authenticated ceph user with read only permissions could steal dm-crypt encryption keys used in ceph disk encryption ...

CWE-285 https://ceph.com/releases/13-2-4-mimic-released https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14662 https://lists.debian.org/debian-lts-announce/2019/03/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00100.html https://usn.ubuntu.com/4035-1/https://access.redhat.com/errata/RHSA-2019:2541 https://access.redhat.com/errata/RHSA-2019:2538 https://lists.debian.org/debian-lts-announce/2021/08/msg00013.html https://usn.ubuntu.com/4035-1/https://nvd.nist.gov

CVE-2018-14662

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect