Known vulnerabilities in ceph-ansible (Red Hat package)

Known vulnerabilities in ceph-ansible (Red Hat package)

Vendor: Red Hat Inc.

Software: ceph-ansible (Red Hat package)

Software CPE: cpe:2.3:o:red_hat:ceph-ansible_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*

Website: https://www.redhat.com/en

Total vulnerabilities: 19

Public exploits: 3

Known exploited (KEV): 1

Highest CVSSv4 Score: 9.2

Breakdown by Severity Chart

Vulnerabilities (19)

Vulnerability	CWE-ID	CSH Severity	Public Exploit	KEV	First fixed release	Published	Bulletins
#VU114318 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') CVE-2021-3524	CWE-113	Low	No	No	4.0.70.3-1.el7cp, 4.0.70.3-1.el8cp, 6.0.25.4-1.el8cp	21.08.2025	SB2021051735 SB2025082110 SB2021051423 and 7 more
#VU85833 - Resource exhaustion CVE-2023-46159	CWE-400	Low	No	No	6.0.28.7-1.el8cp	26.01.2024	SB2024012623 SB2024020929 SB2024110890 and 4 more
#VU85583 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CVE-2023-49569	CWE-22	Medium	No	No	6.0.28.8-1.el8cp	18.01.2024	SB2024011878 SB2024011879 SB2024020832 and 42 more
#VU83546 - Resource exhaustion CVE-2023-45142	CWE-400	Medium	No	No	6.0.28.8-1.el8cp	29.11.2023	SB2023112912 SB2023112913 SB2023112949 and 54 more
#VU82112 - Improper Authorization CVE-2023-43040	CWE-285	Medium	Available	No	6.0.28.7-1.el8cp	17.10.2023	SB2023101761 SB2023112450 SB2024012922 and 5 more
#VU82064 - Resource exhaustion CVE-2023-39325	CWE-400	Medium	No	No	6.0.28.8-1.el8cp	16.10.2023	SB2023101651 SB2023101652 SB2023101653 and 341 more
#VU81728 - Resource exhaustion CVE-2023-44487	CWE-400	High	Available	Exploited	6.0.28.8-1.el8cp	10.10.2023	SB2023101023 SB2023101024 SB2023101037 and 648 more
#VU73108 - Covert Timing Channel CVE-2020-25658	CWE-385	Low	No	No	4.0.70.3-1.el7cp, 4.0.70.3-1.el8cp	07.03.2023	SB2020111232 SB2023030749 SB2022111045 and 7 more
#VU66551 - Use of a Broken or Risky Cryptographic Algorithm CVE-2021-3979	CWE-327	Low	No	No	4.0.70.3-1.el7cp, 4.0.70.3-1.el8cp, 6.0.25.4-1.el8cp	16.08.2022	SB2022081730 SB2022081731 SB2022122122 and 6 more
#VU62463 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CVE-2022-24785	CWE-22	Medium	No	No	6.0.28.3-1.el8cp	20.04.2022	SB2022042016 SB2022042017 SB2022060317 and 65 more
#VU53692 - Improper Authentication CVE-2021-20288	CWE-287	Medium	No	No	3.2.59-1.el7cp	01.06.2021	SB2021060109 SB2021060110 SB2022041926 and 5 more
#VU53311 - Improper input validation CVE-2021-3531	CWE-20	Medium	No	No	6.0.25.4-1.el8cp	17.05.2021	SB2021051713 SB2021051423 SB2021051424 and 4 more
#VU31882 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2020-1760	CWE-79	Medium	No	No	4.0.25-1.el7cp, 4.0.25-1.el8cp	26.07.2020	SB2020042381 SB2020042382 SB2020041035 and 6 more
#VU48628 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CVE-2020-10753	CWE-74	Medium	No	No	3.2.48-1.el7cp, 4.0.25-1.el7cp, 4.0.25-1.el8cp	26.06.2020	SB2020062624 SB2020112420 SB2020112704 and 7 more
#VU14543 - Permissions, Privileges, and Access Controls CVE-2018-1129	CWE-264	Low	No	No	3.0.39-1.el7cp	28.08.2018	SB2018082808 SB2018111511 SB2019042801 and 8 more
#VU14542 - Permissions, Privileges, and Access Controls CVE-2018-1128	CWE-264	Low	No	No	3.0.39-1.el7cp	28.08.2018	SB2018082808 SB2018111511 SB2019042801 and 9 more
#VU14329 - Improper input validation CVE-2018-10861	CWE-20	Low	No	No	3.0.39-1.el7cp	10.08.2018	SB2018082808 SB2018111511 SB2019042801 and 8 more
#VU6639 - Improper input validation CVE-2017-7466	CWE-20	Medium	Available	No	2.1.9-1.el7scon	17.05.2017	SB2017052310 SB2017052601 SB2017070615 and 22 more
#VU1034 - Improper Access Control CVE-2016-7062	CWE-284	Low	No	No	1.0.5-34.el7scon	21.10.2016	SB2016102111 SB2016101947