CVE-2018-16889

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2018-16889
Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption key information in log files via plaintext. Versions up to v13.2.4 are vulnerable.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
http://www.securityfocus.com/bid/106528 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2538
https://access.redhat.com/errata/RHSA-2019:2541
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16889 Exploit Issue Tracking Patch Third Party Advisory
https://usn.ubuntu.com/4035-1/
Configurations

Configuration 1 (hide)

cpe:2.3:a:redhat:ceph:*:*:*:*:*:*:*:*
History

13 Feb 2023, 04:52

Type Values Removed Values Added
References
  • {'url': 'https://access.redhat.com/security/cve/CVE-2018-16889', 'name': 'https://access.redhat.com/security/cve/CVE-2018-16889', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1665334', 'name': 'https://bugzilla.redhat.com/show_bug.cgi?id=1665334', 'tags': [], 'refsource': 'MISC'}
Summary It was found that Ceph RGW did not properly sanitize encryption keys in debug logging for v4 auth. Encryption keys could be inadvertently disclosed when sharing debug logs. Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption key information in log files via plaintext. Versions up to v13.2.4 are vulnerable.
CWE CWE-20
CWE-312
CWE-200		 CWE-532

02 Feb 2023, 16:18

Type Values Removed Values Added
Summary Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption key information in log files via plaintext. Versions up to v13.2.4 are vulnerable. It was found that Ceph RGW did not properly sanitize encryption keys in debug logging for v4 auth. Encryption keys could be inadvertently disclosed when sharing debug logs.
References
  • (MISC) https://access.redhat.com/security/cve/CVE-2018-16889 -
  • (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=1665334 -
Information

Published : 2019-01-28 14:29

Updated : 2023-12-10 12:44

NVD link : CVE-2018-16889

Mitre link : CVE-2018-16889

CVE.ORG link : CVE-2018-16889

JSON object : View

Products Affected

redhat

  • ceph
CWE
CWE-532

Insertion of Sensitive Information into Log File

CWE-20

Improper Input Validation

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-312

Cleartext Storage of Sensitive Information