Encryption Key Exposure Vulnerability in Ceph by Red Hat
CVE-2018-16889

5.5MEDIUM

Key Information:

Vendor

The Ceph Project

Status
Ceph
Vendor
CVE Published:
28 January 2019

What is CVE-2018-16889?

The Ceph storage system contains a vulnerability where encryption keys used for v4 authentication are not adequately sanitized in debug logging. This flaw allows sensitive encryption key information to be exposed in log files in plaintext, potentially allowing unauthorized access to encrypted data. Affected versions include all those up to version 13.2.4, making it critical for users to update to secure releases.

Affected Version(s)

ceph up to v13.2.4

References

http://www.securityfocus.com/bid/106528
vdb-entryx_refsource_BID
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16889
x_refsource_CONFIRM
https://usn.ubuntu.com/4035-1/
vendor-advisoryx_refsource_UBUNTU

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

CVSS V3.0

Score:
5.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.