CVE-2015-4053: Infoleak
The admin command in ceph-deploy before 1.5.25 uses world-readable permissions for /etc/ceph/ceph.client.admin.keyring, which allows local users to obtain sensitive information by reading the file.
Other sources
The admin command in ceph-deploy before 1.5.25 uses world-readable permissions for /etc/ceph/ceph.client.admin.keyring, which allows local users to obtain sensitive information by reading the file.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-4053?
CVE-2015-4053 is classified as a medium severity vulnerability due to its potential for local information exposure.
How do I fix CVE-2015-4053?
To fix CVE-2015-4053, upgrade ceph-deploy to version 1.5.25 or later.
What are the consequences of CVE-2015-4053?
The consequences of CVE-2015-4053 include unauthorized access to sensitive information contained in the admin keyring.
Which versions of ceph-deploy are affected by CVE-2015-4053?
CVE-2015-4053 affects ceph-deploy versions prior to 1.5.25.
Who is impacted by CVE-2015-4053?
Local users on systems running vulnerable versions of ceph-deploy are impacted by CVE-2015-4053.