https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2020-1716.htmlhttps://patchthecve.com/cve/CVE-2020-1716.htmlWed, 17 Jun 2026 03:02:15 +0000HIGH 8.8: A flaw was found in the ceph-ansible playbook where it contained hardcoded passwords that were being used as default passwords while deploying Ceph services. Any authenticated attacker can abuse this flaw to brute-force Ceph deployments, and gain administrator access to Ceph clusters via the Ceph dahttps://patchthecve.com/cve/CVE-2020-25677.htmlhttps://patchthecve.com/cve/CVE-2020-25677.htmlWed, 17 Jun 2026 03:07:06 +0000MEDIUM 5.5: A flaw was found in Ceph-ansible v4.0.41 where it creates an /etc/ceph/iscsi-gateway.conf with insecure default permissions. This flaw allows any user on the system to read sensitive information within this file. The highest threat from this vulnerability is to confidentiality.https://patchthecve.com/cve/CVE-2020-1700.htmlhttps://patchthecve.com/cve/CVE-2020-1700.htmlWed, 17 Jun 2026 03:02:14 +0000MEDIUM 6.5: A flaw was found in the way the Ceph RGW Beast front-end handles unexpected disconnects. An authenticated attacker can abuse this flaw by making multiple disconnect attempts resulting in a permanent leak of a socket connection by radosgw. This flaw could lead to a denial of service condition by pilehttps://patchthecve.com/cve/CVE-2019-10222.htmlhttps://patchthecve.com/cve/CVE-2019-10222.htmlWed, 17 Jun 2026 02:10:31 +0000HIGH 7.5: A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests. An unauthenticated attacker could crash the Ceph RGW server by sending valid HTTP headers and terminating the connection, resulting in a remote denial of service for Ceph RGW clients.https://patchthecve.com/cve/CVE-2019-3821.htmlhttps://patchthecve.com/cve/CVE-2019-3821.htmlWed, 17 Jun 2026 02:35:39 +0000HIGH 7.5: A flaw was found in the way civetweb frontend was handling requests for ceph RGW server with SSL enabled. An unauthenticated attacker could create multiple connections to ceph RADOS gateway to exhaust file descriptors for ceph-radosgw service resulting in a remote denial of service.https://patchthecve.com/cve/CVE-2017-7519.htmlhttps://patchthecve.com/cve/CVE-2017-7519.htmlWed, 17 Jun 2026 01:24:30 +0000LOW 2.3: In Ceph, a format string flaw was found in the way libradosstriper parses input from user. A user could crash an application or service using the libradosstriper library.https://patchthecve.com/cve/CVE-2018-10861.htmlhttps://patchthecve.com/cve/CVE-2018-10861.htmlWed, 17 Jun 2026 01:34:47 +0000HIGH 8.1: A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph storage pools and corrupt snapshot images. Ceph branches master, mimic, luminous and jewel are believed to be affected.https://patchthecve.com/cve/CVE-2017-12155.htmlhttps://patchthecve.com/cve/CVE-2017-12155.htmlWed, 17 Jun 2026 01:02:47 +0000MEDIUM 6.3: A resource-permission flaw was found in the openstack-tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack servi