CVE-2018-16889

Description

Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption key information in log files via plaintext. Versions up to v13.2.4 are vulnerable.

References

https://usn.ubuntu.com/4035-1/

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16889

https://access.redhat.com/errata/RHSA-2019:2541

https://access.redhat.com/errata/RHSA-2019:2538

http://www.securityfocus.com/bid/106528

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3