Read the docs
TI-2018-12099 Aliases CVE-2018-16889GHSA-2xfm-mgc4-j8fx

Sensitive information in log files in ceph

Priority LOW 34CWE-532Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-532.

Summary

Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption key information in log files via plaintext. Versions up to v13.2.4 are vulnerable.

Why it matters now

EPSS 0.00536 45th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Red Hat: 2 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
The Ceph Projectcephup to v13.2.4—No fix listedCNA
  • ceph VendorThe Ceph Project Affected up to v13.2.4 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:redhat:ceph:*:*:*:*:*:*:*:*up to 13.2.4VulnerableRed Hat
  • cpe:2.3:a:redhat:ceph:*:*:*:*:*:*:*:* Versions up to 13.2.4 Vulnerable ·Red Hat

Remediation

Red Hat 2 advisories

  • RHSA-2019:2541 Released 2019-08-21 · Red Hat rating Moderate
    Red Hat Ceph Storage 3.3 security, bug fix, and enhancement update
    • Red Hat Ceph Storage 3 for Ubuntu
  • RHSA-2019:2538 Released 2019-08-21 · Red Hat rating Moderate
    Red Hat Ceph Storage 3.3 security, bug fix, and enhancement update
    • Red Hat Ceph Storage 3.3 MON ceph-2:12.2.12-45.el7cp, ceph-base-2:12.2.12-45.el7cp, ceph-common-2:12.2.12-45.el7cp +17
    • Red Hat Ceph Storage 3.3 OSD ceph-2:12.2.12-45.el7cp, ceph-base-2:12.2.12-45.el7cp, ceph-common-2:12.2.12-45.el7cp +16
    • Red Hat Ceph Storage 3.3 Tools ceph-2:12.2.12-45.el7cp, ceph-ansible-3.2.24-1.el7cp, ceph-base-2:12.2.12-45.el7cp +28

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ceph Storage 3 for UbuntuFixed RHSA-2019:2541
Red Hat Ceph Storage 3.3 MONFixed RHSA-2019:2538
Red Hat Ceph Storage 3.3 OSDFixed RHSA-2019:2538
Red Hat Ceph Storage 3.3 ToolsFixed RHSA-2019:2538
Not affected: 4 products
  • Red Hat Ceph Storage 2
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Virtualization 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-16889
  2. 2026-10-03 Alias added: GHSA-2xfm-mgc4-j8fx

References

Exploit 1

Advisory 3

  • TI-2019-07542 Improper handling of exceptional conditions in ceph CVSS 3.1HIGH 7.5
  • TI-2020-01646 Information disclosure in ceph CVSS 3.1HIGH 7.5
  • TI-2016-06042 The RGW code in Ceph before 10.0.1, when authenticated-read ACL is applied to a bucket… CVSS 3.0HIGH 7.5
  • TI-2020-01702 A vulnerability was found in Red Hat Ceph Storage 4 and Red Hat Openshift Container… CVSS 3.1MEDIUM 6.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences