REDHAT-BUG-1665334: Medium severity ceph vulnerability

Published Jan 11, 2019

Updated

Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption key information in log files via plaintext.

Upstream Patch:

https://github.com/ceph/ceph/pull/25881/commits

Upstream Bug:

http://tracker.ceph.com/issues/37847

Affected Software

1 affected component

ceph Ceph

Event History

Jan 11, 2019

Data Sourced

via Red Hat·02:01 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-1665334?

The severity of REDHAT-BUG-1665334 is considered high due to the potential exposure of sensitive encryption key information in log files.

How do I fix REDHAT-BUG-1665334?

To fix REDHAT-BUG-1665334, apply the available patch as outlined in the upstream commit.

Which versions of Ceph are affected by REDHAT-BUG-1665334?

REDHAT-BUG-1665334 affects all versions of Ceph that do not implement the patch addressing the issue.

What are the implications of REDHAT-BUG-1665334 for security?

The implications of REDHAT-BUG-1665334 for security include the risk of unauthorized access to encryption keys which can compromise data confidentiality.

Is there a workaround for REDHAT-BUG-1665334?

Currently, there are no documented workarounds for REDHAT-BUG-1665334; applying the patch is recommended.