CVE-2016-7031 Information disclosure in n/a
Remote attackers can list bucket contents in Ceph object storage when authenticated-read ACLs are applied, exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-7031?
CVE-2016-7031 is a high-severity vulnerability in n/a, published on 3 Oct 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The RGW code in Ceph before 10.0.1, when authenticated-read ACL is applied to a bucket, allows remote attackers to list the bucket contents via a URL.
Which versions are affected by CVE-2016-7031?
It affects 2 products.
Linux distribution packages (17)
calamari-server Red Hat:ceph_storage:1.3::el7 | All versions | 0:1.3.3-2.el7cp |
ceph Red Hat:ceph_storage:1.3::el7 | All versions | 1:0.94.9-3.el7cp |
ceph-common Red Hat:ceph_storage:1.3::el7 | All versions | 1:0.94.9-3.el7cp |
ceph-debuginfo Red Hat:ceph_storage:1.3::el7 | All versions | 1:0.94.9-3.el7cp |
ceph-deploy Red Hat:ceph_storage:1.3::el7 | All versions | 0:1.5.36-1.el7cp |
ceph-mon Red Hat:ceph_storage:1.3::el7 | All versions | 1:0.94.9-3.el7cp |
ceph-osd Red Hat:ceph_storage:1.3::el7 | All versions | 1:0.94.9-3.el7cp |
ceph-radosgw Red Hat:ceph_storage:1.3::el7 | All versions | 1:0.94.9-3.el7cp |
ceph-selinux Red Hat:ceph_storage:1.3::el7 | All versions | 1:0.94.9-3.el7cp |
ceph-test Red Hat:ceph_storage:1.3::el7 | All versions | 1:0.94.9-3.el7cp |
librados2 Red Hat:ceph_storage:1.3::el7 | All versions | 1:0.94.9-3.el7cp |
librados2-devel Red Hat:ceph_storage:1.3::el7 | All versions | 1:0.94.9-3.el7cp |
librbd1 Red Hat:ceph_storage:1.3::el7 | All versions | 1:0.94.9-3.el7cp |
librbd1-devel Red Hat:ceph_storage:1.3::el7 | All versions | 1:0.94.9-3.el7cp |
python-rados Red Hat:ceph_storage:1.3::el7 | All versions | 1:0.94.9-3.el7cp |
python-rbd Red Hat:ceph_storage:1.3::el7 | All versions | 1:0.94.9-3.el7cp |
radosgw-agent Red Hat:ceph_storage:1.3::el7 | All versions | 0:1.2.7-1.el7cp |
Products include Ceph Project Ceph, Redhat Ceph Storage.
How do I fix CVE-2016-7031?
Upgrade to a fixed version.
Is CVE-2016-7031 being exploited?
There is no known exploitation of CVE-2016-7031 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2016-7031, GHSA-cfww-rhhj-3fwm, RHSA-2016:1972, UBUNTU-CVE-2016-7031.