CVE-2020-1716: Critical severity ceph vulnerability
A flaw was found in the ceph-ansible playbook where it contained hardcoded passwords that were being used as default passwords while deploying Ceph services. Any authenticated attacker can abuse this flaw to brute-force Ceph deployments, and gain administrator access to Ceph clusters via the Ceph dashboard to initiate read, write, and delete Ceph clusters and also modify Ceph cluster configurations. Versions before ceph-ansible 6.0.0alpha1 are affected.
Other sources
A vulnerability was found in ceph-ansible, where hard-coded passwords were found in roles/ceph-defaults/defaults/main.yml.
Reference: https://github.com/ceph/ceph-ansible/blob/bb3eae0c8033dc0ffbee44f490f6ad483bd109b9/roles/ceph-defaults/defaults/main.yml
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-1716?
CVE-2020-1716 is a vulnerability found in the ceph-ansible playbook that contains hardcoded passwords used as default passwords during Ceph deployments.
What is the severity of CVE-2020-1716?
The severity of CVE-2020-1716 is critical with a CVSS score of 8.8.
How does CVE-2020-1716 affect Ceph Ceph-ansible?
CVE-2020-1716 affects Ceph Ceph-ansible versions up to and including 5.0.3.
How can an authenticated attacker exploit CVE-2020-1716?
An authenticated attacker can exploit CVE-2020-1716 by brute-forcing Ceph deployments and gaining administrator access to Ceph clusters using the hardcoded default passwords.
Is there a fix available for CVE-2020-1716?
Yes, the fix for CVE-2020-1716 is available in version 6.0.0 of redhat/ceph-ansible.