CVE-2018-16889 - OpenCVE

Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption key information in log files via plaintext. Versions up to v13.2.4 are vulnerable.

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

AV:N/AC:L/Au:N/C:P/I:N/A:N

Vendors & Products
CPE Configurations

Vendors	Products
Redhat	Ceph

Configuration 1 [-]

cpe:2.3:a:redhat:ceph:*:*:*:*:*:*:*:*

References

Link	Resource
http://www.securityfocus.com/bid/106528	Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2538
https://access.redhat.com/errata/RHSA-2019:2541
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16889	Exploit Issue Tracking Patch Third Party Advisory
https://usn.ubuntu.com/4035-1/

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: redhat

Published: 2019-01-28T14:00:00

Updated: 2019-08-21T17:06:09

Reserved: 2018-09-11T00:00:00

Link: CVE-2018-16889

JSON object: View

NVD Information

Status : Modified

Published: 2019-01-28T14:29:00.220

Modified: 2023-02-13T04:52:43.280

Link: CVE-2018-16889

JSON object: View

Redhat Information

No data.

CWE

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:ceph:*:*:*:*:*:*:*:*", "matchCriteriaId": "7AA1712C-B75C-40C0-8001-B1237B80E061", "versionEndIncluding": "13.2.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption key information in log files via plaintext. Versions up to v13.2.4 are vulnerable."}, {"lang": "es", "value": "Ceph no sanea de manera correcta las claves de cifrado en registros de depuraci\u00f3n para autenticaciones v4. Esto resulta en el filtrado de informaci\u00f3n sobre las claves de cifrado en los archivos de registro mediante texto plano. Las versiones hasta la v13.2.4 son vulnerables."}], "id": "CVE-2018-16889", "lastModified": "2023-02-13T04:52:43.280", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "secalert@redhat.com", "type": "Secondary"}]}, "published": "2019-01-28T14:29:00.220", "references": [{"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "http://www.securityfocus.com/bid/106528"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2019:2538"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2019:2541"}, {"source": "secalert@redhat.com", "tags": ["Exploit", "Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16889"}, {"source": "secalert@redhat.com", "url": "https://usn.ubuntu.com/4035-1/"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-532"}], "source": "secalert@redhat.com", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-312"}], "source": "nvd@nist.gov", "type": "Secondary"}]}