PT-2019-9383 · Ceph+3 · Ceph+3

Sam Fowler · Published 2019-01-28 · Updated 2023-02-13 · CVE-2018-16889

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ceph versions up to v13.2.4

Description The issue is related to the improper sanitization of encryption keys in debug logging for v4 auth, resulting in the leaking of encryption key information in log files via plaintext.

Recommendations For versions up to v13.2.4, update to a version later than v13.2.4 to resolve the issue. As a temporary workaround, consider disabling debug logging for v4 auth to minimize the risk of exploitation.

Exploit

Fix

Information Disclosure

Insertion into Log File

RCE

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-200

CWE-532

CWE-20

CWE-312

Related Identifiers

ALT-PU-2019-1500

CVE-2018-16889

OPENSUSE-SU-2019_0306-1

OPENSUSE-SU-2024:10676-1

RHSA-2019:2538

SUSE-SU-2019:0499-1

SUSE-SU-2019:2049-1

SUSE-SU-2019:2364-1

SUSE-SU-2019_0499-1

SUSE-SU-2019_2049-1

SUSE-SU-2019_2364-1

USN-4035-1

Affected Products

Alt Linux

Ceph

Suse

Ubuntu

References · 66

• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16889 · Exploit
• https://osv.dev/vulnerability/CVE-2018-16889 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:2538 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-01537 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2019:2049-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-16889 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4035-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-01538 · Security Note
• https://errata.altlinux.org/ALT-PU-2019-1500 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-03718 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12059 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3821 · Security Note
• https://osv.dev/vulnerability/USN-4035-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14662 · Security Note
• https://ubuntu.com/security/CVE-2018-16846 · Vendor Advisory