CVE-2020-1716
First published: Tue Jan 28 2020(Updated: )
A flaw was found in the ceph-ansible playbook where it contained hardcoded passwords that were being used as default passwords while deploying Ceph services. Any authenticated attacker can abuse this flaw to brute-force Ceph deployments, and gain administrator access to Ceph clusters via the Ceph dashboard to initiate read, write, and delete Ceph clusters and also modify Ceph cluster configurations. Versions before ceph-ansible 6.0.0alpha1 are affected.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Ceph Ceph-ansible | <=5.0.3 | |
| redhat/ceph-ansible | <6.0.0 | 6.0.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=1795592
- https://github.com/ceph/ceph-ansible/blob/bb3eae0c8033dc0ffbee44f490f6ad483bd109b9/roles/ceph-defaults/defaults/main.yml
- https://github.com/ceph/ceph-ansible/pull/4998
- https://github.com/ceph/ceph-ansible/blob/v4.0.14/roles/ceph-defaults/defaults/main.yml#L701
- https://github.com/ceph/ceph-ansible/blob/v4.0.14/roles/ceph-defaults/defaults/main.yml#L711
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1813137
- https://access.redhat.com/errata/RHSA-2020:2231
- https://access.redhat.com/security/cve/cve-2020-1716
Frequently Asked Questions
What is CVE-2020-1716?
CVE-2020-1716 is a vulnerability found in the ceph-ansible playbook that contains hardcoded passwords used as default passwords during Ceph deployments.
What is the severity of CVE-2020-1716?
The severity of CVE-2020-1716 is critical with a CVSS score of 8.8.
How does CVE-2020-1716 affect Ceph Ceph-ansible?
CVE-2020-1716 affects Ceph Ceph-ansible versions up to and including 5.0.3.
How can an authenticated attacker exploit CVE-2020-1716?
An authenticated attacker can exploit CVE-2020-1716 by brute-forcing Ceph deployments and gaining administrator access to Ceph clusters using the hardcoded default passwords.
Is there a fix available for CVE-2020-1716?
Yes, the fix for CVE-2020-1716 is available in version 6.0.0 of redhat/ceph-ansible.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- agent/author
- agent/severity
- agent/references
- agent/weakness
- agent/description
- agent/tags
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2020-1716
- agent/software-canonical-lookup
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- vendor/ceph
- canonical/ceph ceph-ansible
- version/ceph ceph-ansible/5.0.3
- package-manager/redhat