PT-2019-9383

CVE-2018-16889

Publicado

2019-01-28

Atualizado

2023-02-13

Descrição por

CVSS 3.1

7.5

Alta

MétricasAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ceph versions up to v13.2.4

Description The issue is related to the improper sanitization of encryption keys in debug logging for v4 auth, resulting in the leaking of encryption key information in log files via plaintext.

Recommendations For versions up to v13.2.4, update to a version later than v13.2.4 to resolve the issue. As a temporary workaround, consider disabling debug logging for v4 auth to minimize the risk of exploitation.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Sam Fowler

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

CWE-532: Insertion of Sensitive Information into Log File

CWE-20: Improper Input Validation