CVE-2020-25677
First published: Tue Oct 27 2020(Updated: )
A flaw was found in Ceph-ansible v4.0.41 where it creates an /etc/ceph/iscsi-gateway.conf with insecure default permissions. This flaw allows any user on the system to read sensitive information within this file. The highest threat from this vulnerability is to confidentiality.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/ceph-ansible | <0:4.0.41-1.el8c | 0:4.0.41-1.el8c |
| redhat/ceph-ansible | <4.0.41 | 4.0.41 |
| Ceph Ceph-ansible | =4.0.41 | |
| Redhat Ceph Storage | =3.0 | |
| Redhat Ceph Storage | =4.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=1892108
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1892106
- https://github.com/ceph/ceph-ansible/pull/5964
- https://access.redhat.com/errata/RHSA-2021:0081
- https://access.redhat.com/security/cve/cve-2020-25677
- https://www.cve.org/CVERecord?id=CVE-2020-25677 https://nvd.nist.gov/vuln/detail/CVE-2020-25677
- https://access.redhat.com/errata/RHBA-2021:0305
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2020-25677.
What is the title of the vulnerability?
The title of the vulnerability is 'A flaw was found in Ceph-ansible where it creates an /etc/ceph/iscsi-gateway.conf with insecure default permissions.'
What software is affected by this vulnerability?
The software affected by this vulnerability is Ceph-ansible v4.0.41.
What is the severity of CVE-2020-25677?
The severity of CVE-2020-25677 is medium.
How can I fix the vulnerability?
To fix the vulnerability, update Ceph-ansible to version 4.0.41 or apply the appropriate security patches.
- collector/redhat-cve
- agent/type
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/references
- agent/remedy
- agent/severity
- agent/weakness
- agent/author
- agent/tags
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2020-25677
- agent/software-canonical-lookup
- agent/event
- collector/nvd-index
- agent/software-canonical-lookup-request
- package-manager/redhat
- vendor/ceph
- canonical/ceph ceph-ansible
- version/ceph ceph-ansible/4.0.41
- vendor/redhat
- canonical/redhat ceph storage
- version/redhat ceph storage/3.0
- version/redhat ceph storage/4.0