PT-2015-6052 · Ceph · Ceph-Deploy

Andreas Stieger · Publicado 2015-05-31 · Atualizado 2022-05-17 · CVE-2015-3010

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions ceph-deploy versions prior to 1.5.23

Description The issue allows local users to obtain sensitive information by reading the ceph/ceph.client.admin.keyring file due to weak permissions (644) used by ceph-deploy.

Recommendations For versions prior to 1.5.23, update to version 1.5.23 or later to resolve the issue. As a temporary workaround, consider changing the permissions of the ceph/ceph.client.admin.keyring file to restrict access until a patch is applied.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2015-3010

GHSA-9W4F-3V37-6F75

PYSEC-2015-2

RHSA-2015:1092

SUSE-SU-2015:1102-1

Produtos afetados

Ceph-Deploy

Referências · 38

• https://github.com/ceph/ceph-deploy/commit/eee56770393bf19ed2dd5389226c6190c08dee3f · Nota
• https://github.com/ceph/ceph-deploy/pull/272 · Nota
• https://github.com/ceph/ceph-deploy · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/ceph-deploy/PYSEC-2015-2.yaml · Nota
• https://bugzilla.suse.com/924269 · Nota
• https://bugzilla.suse.com/919091 · Nota
• https://bugzilla.suse.com/927862 · Nota
• https://bugzilla.suse.com/915567 · Nota
• https://bugzilla.suse.com/924894 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155631.html · Aviso do Fabricante
• https://web.archive.org/web/20200228233028/http://securityfocus.com/bid/74043 · Nota
• http://securityfocus.com/bid/74043 · Nota
• https://suse.com/security/cve/CVE-2014-3589 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155576.html · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2015-3010 · Nota de Segurança