TI-2018-12099 CVE-2018-16889 · GHSA-2xfm-mgc4-j8fx
Sensitive information in log files in ceph
Priority LOW 34
Ceph does not properly sanitize encryption keys in debug logging for v4 auth.
RHSA-2019:2538
Red Hat Ceph Storage 3.3 security, bug fix, and enhancement update
Released 2019-08-21 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Ceph Storage 3.3 MON ceph-2:12.2.12-45.el7cp, ceph-base-2:12.2.12-45.el7cp, ceph-common-2:12.2.12-45.el7cp +17
- Red Hat Ceph Storage 3.3 OSD ceph-2:12.2.12-45.el7cp, ceph-base-2:12.2.12-45.el7cp, ceph-common-2:12.2.12-45.el7cp +16
- Red Hat Ceph Storage 3.3 Tools ceph-2:12.2.12-45.el7cp, ceph-ansible-3.2.24-1.el7cp, ceph-base-2:12.2.12-45.el7cp +28
Fixes 3 records
TI-2018-12056 CVE-2018-16846 · GHSA-77fq-6x6c-cq7q
Resource allocation without limits in [UNKNOWN] ceph
Priority LOW 33
It was found in Ceph versions before 13.2.4 that authenticated ceph RGW users can cause a denial of service against OMAPs holding bucket indices.
TI-2018-10525 CVE-2018-14662 · GHSA-w2x2-w9fr-cf6g
Improper authorization in [UNKNOWN] ceph
Priority LOW 26
It was found Ceph versions before 13.2.4 that authenticated ceph users with read only permissions could steal dm-crypt encryption keys used in ceph disk encryption.