CVE-2020-25678
published 2021-01-08CVE-2020-25678: A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in clear text. This can be found by searching the mgr logs for…
PriorityP418medium4.4CVSS 3.1
AVLACLPRHUINSUCHINAN
EPSS
0.27%
18.7th percentile
A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in clear text. This can be found by searching the mgr logs for grafana and dashboard, with passwords visible.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | ceph | < ceph 14.2.18-1 (bookworm) | ceph 14.2.18-1 (bookworm) |
| fedoraproject | fedora | — | — |
| redhat | ceph | < 16.2.0 | 16.2.0 |
| redhat | ceph | — | — |
| redhat | ceph | >= 0 < 14.2.18-1 | 14.2.18-1 |
| redhat | ceph | >= 0 < 14.2.18-1 | 14.2.18-1 |
| redhat | ceph | >= 0 < 14.2.18-1 | 14.2.18-1 |
| redhat | ceph | >= 0 < 14.2.18-1 | 14.2.18-1 |
| redhat | ceph | >= 0 < 15.2.12-0ubuntu0.20.04.1 | 15.2.12-0ubuntu0.20.04.1 |
| redhat | ceph_storage | — | — |
CVSS provenance
nvdv3.14.4MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:P/I:N/A:N
osv4.4MEDIUM
vendor_debian4.4MEDIUM
vendor_redhat4.4MEDIUM
vendor_ubuntu4.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Ceph vulnerabilities
vendor_ubuntu·2021-06-25·CVSS 4.4
CVE-2021-3509 [MEDIUM] Ceph vulnerabilities
Title: Ceph vulnerabilities
Summary: Several security issues were fixed in Ceph.
It was discovered that in some situations Ceph logged passwords from the
mgr module in clear text. An attacker could use this to expose sensitive
information. (CVE-2020-25678)
Goutham Pacha Ravi, Jahson Babel, and John Garbutt discovered that user
credentials in Ceph could be manipulated in certain environments. An
attacker could use this to gain unintended access. (CVE-2020-27781)
It was discovered that the Ceph dashboard was susceptible to a cross-site
scripting attack. An attacker could use this to expose sensitive
information or gain unintended access. (CVE-2020-27839)
It was discovered that Ceph contained an authentication flaw, leading to
key reuse. An attacker could use this to cause a denial of se
Red Hat
ceph: mgr modules' passwords are in clear text in mgr logs
vendor_redhat·2020-11-23·CVSS 4.4
CVE-2020-25678 [MEDIUM] CWE-312 ceph: mgr modules' passwords are in clear text in mgr logs
ceph: mgr modules' passwords are in clear text in mgr logs
A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in clear text. This can be found by searching the mgr logs for grafana and dashboard, with passwords visible.
A flaw was found in Ceph where Ceph stores mgr module passwords in clear text. This issue can be found by searching the mgr logs for Grafana and dashboard, with passwords visible. The highest threat from this vulnerability is to confidentiality.
Statement: * Red Hat Ceph Storage 4 is affected by this flaw, with the passwords visible under sudo. Red Hat Ceph Storage 3 is not affected by this flaw, and does not log passwords by default.
* Red Hat OpenShift Container Storage (RHOCS) 4 shipped Ceph package for the usage of RHOCS 4.2 o
Debian
CVE-2020-25678: ceph - A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr modul...
vendor_debian·2020·CVSS 4.4
CVE-2020-25678 [MEDIUM] CVE-2020-25678: ceph - A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr modul...
A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in clear text. This can be found by searching the mgr logs for grafana and dashboard, with passwords visible.
Scope: local
bookworm: resolved (fixed in 14.2.18-1)
bullseye: resolved (fixed in 14.2.18-1)
forky: resolved (fixed in 14.2.18-1)
sid: resolved (fixed in 14.2.18-1)
trixie: resolved (fixed in 14.2.18-1)
GHSA
GHSA-h22j-342g-797c: A flaw was found in ceph in versions prior to 16
ghsa_unreviewed·2022-05-24
CVE-2020-25678 [MEDIUM] CWE-312 GHSA-h22j-342g-797c: A flaw was found in ceph in versions prior to 16
A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in clear text. This can be found by searching the mgr logs for grafana and dashboard, with passwords visible.
OSV
ceph vulnerabilities
osv·2021-06-25·CVSS 4.4
CVE-2020-25678 [MEDIUM] ceph vulnerabilities
ceph vulnerabilities
It was discovered that in some situations Ceph logged passwords from the
mgr module in clear text. An attacker could use this to expose sensitive
information. (CVE-2020-25678)
Goutham Pacha Ravi, Jahson Babel, and John Garbutt discovered that user
credentials in Ceph could be manipulated in certain environments. An
attacker could use this to gain unintended access. (CVE-2020-27781)
It was discovered that the Ceph dashboard was susceptible to a cross-site
scripting attack. An attacker could use this to expose sensitive
information or gain unintended access. (CVE-2020-27839)
It was discovered that Ceph contained an authentication flaw, leading to
key reuse. An attacker could use this to cause a denial of service or
possibly impersonate another user. (CVE-2021-20288)
OSV
CVE-2020-25678: A flaw was found in ceph in versions prior to 16
osv·2021-01-08·CVSS 4.4
CVE-2020-25678 [MEDIUM] CVE-2020-25678: A flaw was found in ceph in versions prior to 16
A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in clear text. This can be found by searching the mgr logs for grafana and dashboard, with passwords visible.
No detection rules found.
No public exploits indexed.
https://bugzilla.redhat.com/show_bug.cgi?id=1892109https://lists.debian.org/debian-lts-announce/2023/10/msg00034.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OQTBKVXVYP7GPQNZ5VASOIJHMLK7727M/https://security.gentoo.org/glsa/202105-39https://tracker.ceph.com/issues/37503https://bugzilla.redhat.com/show_bug.cgi?id=1892109https://lists.debian.org/debian-lts-announce/2023/10/msg00034.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OQTBKVXVYP7GPQNZ5VASOIJHMLK7727M/https://security.gentoo.org/glsa/202105-39https://tracker.ceph.com/issues/37503
2021-01-08
Published