CVE-2015-3010: Infoleak
ceph-deploy before 1.5.23 uses weak permissions (644) for ceph/ceph.client.admin.keyring, which allows local users to obtain sensitive information by reading the file.
Other sources
ceph-deploy before 1.5.23 uses weak permissions (644) for ceph/ceph.client.admin.keyring, which allows local users to obtain sensitive information by reading the file.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-3010?
CVE-2015-3010 is classified as a medium severity vulnerability due to weak file permissions that can expose sensitive information.
How do I fix CVE-2015-3010?
To fix CVE-2015-3010, upgrade ceph-deploy to version 1.5.23 or later.
What kind of information can be leaked due to CVE-2015-3010?
CVE-2015-3010 allows local users to read the ceph.client.admin.keyring file, potentially exposing sensitive authentication keys.
Which versions of ceph-deploy are affected by CVE-2015-3010?
CVE-2015-3010 affects ceph-deploy versions prior to 1.5.23, including version 1.5.22.
Who is impacted by CVE-2015-3010?
Local users on systems running affected versions of ceph-deploy may be at risk of unauthorized access to the ceph.client.admin.keyring file.