The Ceph Project vulnerabilities
4 vulnerabilities
Known vulnerabilities in The Ceph Project products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 1 product.
Products
1- Ceph4 vulnerabilities
PrioritiseCVE-2020-1699the ceph project · ceph +5 morethe ceph project cephA path traversal flaw was found in the Ceph dashboard implemented in upstream versions v14.2.5, v14.2.6, v15.0.0 of Ceph storage and has been fixed in versions 14.2.7 and 15.1.0. An unauthenticated attacker could use this flaw to cause information disclosure on the host machine running the Ceph dashboard.CVSS7.5HighEPSS2.14%RoutineCVE-2020-1759the ceph project · ceph +72 morethe ceph project cephA vulnerability was found in Red Hat Ceph Storage 4 and Red Hat Openshift Container Storage 4.2 where, A nonce reuse vulnerability was discovered in the secure mode of the messenger v2 protocol, which can allow an attacker to forge auth tags and potentially manipulate the data by leveraging the reuse of a nonce in a session. Messages encrypted using a reused nonce value are susceptible to serious confidentiality and integrity attacks.CVSS6.8MediumEPSS1.63%PrioritiseCVE-2019-10222the ceph project · ceph +47 morethe ceph project cephA flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests. An unauthenticated attacker could crash the Ceph RGW server by sending valid HTTP headers and terminating the connection, resulting in a remote denial of service for Ceph RGW clients.CVSS7.5HighEPSS4.52%RoutineCVE-2018-16889the ceph project · ceph +8 morethe ceph project cephCeph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption key information in log files via plaintext. Versions up to v13.2.4 are vulnerable.CVSS7.5HighEPSS0.54%