PT-2019-9383

CVE-2018-16889

Published

2019-01-28

Updated

2023-02-13

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ceph versions up to v13.2.4

Description The issue is related to the improper sanitization of encryption keys in debug logging for v4 auth, resulting in the leaking of encryption key information in log files via plaintext.

Recommendations For versions up to v13.2.4, update to a version later than v13.2.4 to resolve the issue. As a temporary workaround, consider disabling debug logging for v4 auth to minimize the risk of exploitation.

Exploitability

Exploit

Fix

Impacts

Researchers

Sam Fowler

Vendors

Affected products

Weakness enumeration

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

CWE-532: Insertion of Sensitive Information into Log File

CWE-20: Improper Input Validation