PT-2015-6052 · Ceph · Ceph-Deploy

Andreas Stieger · Published 2015-05-31 · Updated 2022-05-17 · CVE-2015-3010

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions ceph-deploy versions prior to 1.5.23

Description The issue allows local users to obtain sensitive information by reading the ceph/ceph.client.admin.keyring file due to weak permissions (644) used by ceph-deploy.

Recommendations For versions prior to 1.5.23, update to version 1.5.23 or later to resolve the issue. As a temporary workaround, consider changing the permissions of the ceph/ceph.client.admin.keyring file to restrict access until a patch is applied.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2015-3010

GHSA-9W4F-3V37-6F75

PYSEC-2015-2

RHSA-2015:1092

SUSE-SU-2015:1102-1

Affected Products

Ceph-Deploy

References · 38

• http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155631.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155576.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-3010 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2015:1102-1 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1092.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9w4f-3v37-6f75 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-3010 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-3010 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2015-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-3010 · Vendor Advisory
• https://github.com/ceph/ceph-deploy/commit/eee56770393bf19ed2dd5389226c6190c08dee3f · Note
• https://github.com/ceph/ceph-deploy/pull/272 · Note
• https://github.com/ceph/ceph-deploy · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/ceph-deploy/PYSEC-2015-2.yaml · Note
• https://bugzilla.suse.com/924269 · Note