PT-2015-6400 · Ceph · Ceph-Deploy

Andreas Stieger · Published 2015-06-08 · Updated 2024-06-15 · CVE-2015-4053

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions ceph-deploy versions prior to 1.5.25

Description The issue concerns the admin command in ceph-deploy, which uses world-readable permissions for the /etc/ceph/ceph.client.admin.keyring file. This allows local users to obtain sensitive information by reading the file.

Recommendations For versions prior to 1.5.25, update to version 1.5.25 or later to resolve the issue. As a temporary workaround, consider changing the permissions of the /etc/ceph/ceph.client.admin.keyring file to restrict access until a patch is applied.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2015-4053

GHSA-79JF-CCM8-43W7

OPENSUSE-SU-2024:10213-1

PYSEC-2015-3

RHSA-2015:1092

Affected Products

Ceph-Deploy

References · 19

• http://tracker.ceph.com/issues/11694 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1092.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-4053 · Security Note
• https://cve.org/CVERecord?id=CVE-2015-4053 · Security Note
• https://osv.dev/vulnerability/PYSEC-2015-3 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-4053 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10213-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-79jf-ccm8-43w7 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-4053 · Vendor Advisory
• https://github.com/ceph/ceph-deploy/commit/9f9fd6e3372043bd2fd67582324c8fb5d7aa361e · Note
• https://github.com/ceph/ceph-deploy · Note
• https://github.com/ceph/ceph-deploy/pull/300 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/ceph-deploy/PYSEC-2015-3.yaml · Note
• http://openwall.com/lists/oss-security/2015/05/21/13 · Note
• https://web.archive.org/web/20200228093353/http://securityfocus.com/bid/74775 · Note