Vulnerability Details : CVE-2018-16889
Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption key information in log files via plaintext. Versions up to v13.2.4 are vulnerable.
Vulnerability category: Input validationInformation leak
Products affected by CVE-2018-16889
- cpe:2.3:a:redhat:ceph:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2018-16889
0.16%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 52 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2018-16889
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:P/I:N/A:N |
10.0
|
2.9
|
NIST | |
|
7.5
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
3.9
|
3.6
|
NIST | |
|
5.5
|
MEDIUM | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
1.8
|
3.6
|
Red Hat, Inc. |
CWE ids for CVE-2018-16889
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Secondary)
-
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Assigned by: nvd@nist.gov (Secondary)
-
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.Assigned by: nvd@nist.gov (Secondary)
-
The product writes sensitive information to a log file.Assigned by: secalert@redhat.com (Primary)
References for CVE-2018-16889
-
https://usn.ubuntu.com/4035-1/
USN-4035-1: Ceph vulnerabilities | Ubuntu security notices
-
https://access.redhat.com/errata/RHSA-2019:2538
RHSA-2019:2538 - Security Advisory - Red Hat Customer Portal
-
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16889
1665334 – (CVE-2018-16889) CVE-2018-16889 ceph: debug logging for v4 auth does not sanitize encryption keysExploit;Issue Tracking;Patch;Third Party Advisory
-
https://access.redhat.com/errata/RHSA-2019:2541
RHSA-2019:2541 - Security Advisory - Red Hat Customer Portal
-
http://www.securityfocus.com/bid/106528
Redhat Ceph Storage CVE-2018-16889 Information Disclosure VulnerabilityThird Party Advisory
Jump to