CVE-2015-4053

Name of the Vulnerable Software and Affected Versions ceph-deploy versions prior to 1.5.25

Description The issue concerns the admin command in ceph-deploy, which uses world-readable permissions for the /etc/ceph/ceph.client.admin.keyring file. This allows local users to obtain sensitive information by reading the file.

Recommendations For versions prior to 1.5.25, update to version 1.5.25 or later to resolve the issue. As a temporary workaround, consider changing the permissions of the /etc/ceph/ceph.client.admin.keyring file to restrict access until a patch is applied.