CVE-2018-16889 Information disclosure in ceph
Attackers can read encryption keys from Ceph debug logs due to improper sanitization, compromising stored data security.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-16889?
CVE-2018-16889 is a medium-severity vulnerability in The Ceph Project ceph, published on 28 Jan 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption key information in log files via plaintext. Versions up to v13.2.4 are vulnerable.
Which versions are affected by CVE-2018-16889?
It affects 1 product.
Linux distribution packages (5)
ceph SUSE:Enterprise Storage 5 | All versions | 12.2.12+git.1568024032.02236657ca-2.39.1 |
ceph SUSE:Linux Enterprise Desktop 12 SP4 | All versions | 12.2.12+git.1568024032.02236657ca-2.39.1 |
ceph SUSE:Linux Enterprise Server 12 SP4 | All versions | 12.2.12+git.1568024032.02236657ca-2.39.1 |
ceph SUSE:Linux Enterprise Server for SAP Applications 12 SP4 | All versions | 12.2.12+git.1568024032.02236657ca-2.39.1 |
ceph SUSE:Linux Enterprise Software Development Kit 12 SP4 | All versions | 12.2.12+git.1568024032.02236657ca-2.39.1 |
Products include Redhat Ceph.
How do I fix CVE-2018-16889?
Apply the vendor's patch.
Is CVE-2018-16889 being exploited?
There is no known exploitation of CVE-2018-16889 in the wild and no public exploit code.
Other vulnerabilities in The Ceph Project ceph
Sources
Also known as DEBIAN-CVE-2018-16889, GHSA-2xfm-mgc4-j8fx, SUSE-SU-2019:2364-1, UBUNTU-CVE-2018-16889.