Cleartext storage of sensitive information in Ceph - CVE-2020-25678

Vulnerability identifier: #VU53682

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-25678

CWE-ID: CWE-312

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists in Ceph due ti application stores the mgr module passwords in clear text. A local user can gain access to the password by searching the mgr logs for grafana and dashboard.

Ceph
Gentoo Linux
openEuler
python3-rgw
python3-cephfs
ceph-common
ceph-mds
libcephfs2
ceph-selinux
python-cephfs
ceph-resource-agents
libradosstriper-devel
librbd-devel
librbd1
python-rados
libcephfs-devel
rados-objclass-devel
python3-rados
python-rbd
python3-ceph-argparse
librados2
ceph-base
python3-rbd
librgw2
ceph-radosgw
librados-devel
ceph-osd
ceph-mgr
ceph-mon
rbd-mirror
librgw-devel
rbd-nbd
ceph
libradosstriper1
ceph-debugsource
python-ceph-compat
ceph-test
rbd-fuse
python-rgw
ceph-debuginfo
ceph-fuse

Install updates from vendor's website.

Ceph - update to 15.2.9
python3-rgw - update to 12.2.8-11
python3-cephfs - update to 12.2.8-11
ceph-common - update to 12.2.8-11
ceph-mds - update to 12.2.8-11
libcephfs2 - update to 12.2.8-11
ceph-selinux - update to 12.2.8-11
python-cephfs - update to 12.2.8-11
ceph-resource-agents - update to 12.2.8-11
libradosstriper-devel - update to 12.2.8-11
librbd-devel - update to 12.2.8-11
librbd1 - update to 12.2.8-11
python-rados - update to 12.2.8-11
libcephfs-devel - update to 12.2.8-11
rados-objclass-devel - update to 12.2.8-11
python3-rados - update to 12.2.8-11
python-rbd - update to 12.2.8-11
python3-ceph-argparse - update to 12.2.8-11
librados2 - update to 12.2.8-11
ceph-base - update to 12.2.8-11
python3-rbd - update to 12.2.8-11
librgw2 - update to 12.2.8-11
ceph-radosgw - update to 12.2.8-11
librados-devel - update to 12.2.8-11
ceph-osd - update to 12.2.8-11
ceph-mgr - update to 12.2.8-11
ceph-mon - update to 12.2.8-11
rbd-mirror - update to 12.2.8-11
librgw-devel - update to 12.2.8-11
rbd-nbd - update to 12.2.8-11
ceph - update to 12.2.8-11
libradosstriper1 - update to 12.2.8-11
ceph-debugsource - update to 12.2.8-11
python-ceph-compat - update to 12.2.8-11
ceph-test - update to 12.2.8-11
rbd-fuse - update to 12.2.8-11
python-rgw - update to 12.2.8-11
ceph-debuginfo - update to 12.2.8-11
ceph-fuse - update to 12.2.8-11

• https://bugzilla.redhat.com/show_bug.cgi?id=1892109
• https://tracker.ceph.com/issues/37503
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OQTBKVXVYP7GPQNZ5VASOIJHMLK7727M/
• https://security.gentoo.org/glsa/202105-39

• Clear text passwords for mgr module in Cepth
• Gentoo update for Ceph
• openEuler update for ceph