PatchTheCVEceph vulnerabilities
Recent CVEs affecting ceph products. 8 tracked.
ceph has 8 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2021-05-28. Highest priority: CVE-2019-10222 (score 59/100).
- CVE-2020-25677 MEDIUM 5.5 DOWNGRADE DOWNGRADE A flaw was found in Ceph-ansible v4.0.41 where it creates an /etc/ceph/iscsi-gateway.conf with insecure defaul
- CVE-2020-1716 HIGH 8.8 UPGRADE A flaw was found in the ceph-ansible playbook where it contained hardcoded passwords that were being used as d
- CVE-2020-1700 MEDIUM 6.5 MITIGATE DOWNGRADE A flaw was found in the way the Ceph RGW Beast front-end handles unexpected disconnects
- CVE-2019-3821 HIGH 7.5 UPGRADE MITIGATE A flaw was found in the way civetweb frontend was handling requests for ceph RGW server with SSL enabled
- CVE-2019-10222 HIGH 7.5 MITIGATE DOWNGRADE A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests
- CVE-2018-10861 HIGH 8.1 DOWNGRADE DOWNGRADE A flaw was found in the way ceph mon handles user requests
- CVE-2017-7519 LOW 2.3 MITIGATE MITIGATE In Ceph, a format string flaw was found in the way libradosstriper parses input from user
- CVE-2017-12155 MEDIUM 6.3 MITIGATE A resource-permission flaw was found in the openstack-tripleo-heat-templates package where ceph.client.opensta
FAQ
How do I fix ceph vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is ceph being exploited right now?
None of the tracked ceph CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which ceph CVE should I patch first?
CVE-2019-10222 currently ranks highest (59/100): A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests.