Ceph
Products by Ceph Sorted by Most Security Vulnerabilities since 2018
By the Year
In 2024 there have been 0 vulnerabilities in Ceph . Ceph did not have any published security vulnerabilities last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2024 | 0 | 0.00 |
| 2023 | 0 | 0.00 |
| 2022 | 1 | 9.10 |
| 2021 | 1 | 8.80 |
| 2020 | 1 | 6.50 |
| 2019 | 2 | 7.50 |
| 2018 | 2 | 7.30 |
It may take a day or so for new Ceph vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Ceph Security Vulnerabilities
A flaw was found in Openstack manilla owning a Ceph File system "share"
CVE-2022-0670
9.1 - Critical
- July 25, 2022
A flaw was found in Openstack manilla owning a Ceph File system "share", which enables the owner to read/write any manilla share or entire file system. The vulnerability is due to a bug in the "volumes" plugin in Ceph Manager. This allows an attacker to compromise Confidentiality and Integrity of a file system. Fixed in RHCS 5.2 and Ceph 17.2.2.
A flaw was found in the ceph-ansible playbook where it contained hardcoded passwords
CVE-2020-1716
8.8 - High
- May 28, 2021
A flaw was found in the ceph-ansible playbook where it contained hardcoded passwords that were being used as default passwords while deploying Ceph services. Any authenticated attacker can abuse this flaw to brute-force Ceph deployments, and gain administrator access to Ceph clusters via the Ceph dashboard to initiate read, write, and delete Ceph clusters and also modify Ceph cluster configurations. Versions before ceph-ansible 6.0.0alpha1 are affected.
Use of Hard-coded Credentials
A flaw was found in the way the Ceph RGW Beast front-end handles unexpected disconnects
CVE-2020-1700
6.5 - Medium
- February 07, 2020
A flaw was found in the way the Ceph RGW Beast front-end handles unexpected disconnects. An authenticated attacker can abuse this flaw by making multiple disconnect attempts resulting in a permanent leak of a socket connection by radosgw. This flaw could lead to a denial of service condition by pile up of CLOSE_WAIT sockets, eventually leading to the exhaustion of available resources, preventing legitimate users from connecting to the system.
Resource Exhaustion
A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests
CVE-2019-10222
7.5 - High
- November 08, 2019
A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests. An unauthenticated attacker could crash the Ceph RGW server by sending valid HTTP headers and terminating the connection, resulting in a remote denial of service for Ceph RGW clients.
Improper Handling of Exceptional Conditions
A flaw was found in the way civetweb frontend was handling requests for ceph RGW server with SSL enabled
CVE-2019-3821
7.5 - High
- March 27, 2019
A flaw was found in the way civetweb frontend was handling requests for ceph RGW server with SSL enabled. An unauthenticated attacker could create multiple connections to ceph RADOS gateway to exhaust file descriptors for ceph-radosgw service resulting in a remote denial of service.
Resource Management Errors
A flaw was found in the way signature calculation was handled by cephx authentication protocol
CVE-2018-1129
6.5 - Medium
- July 10, 2018
A flaw was found in the way signature calculation was handled by cephx authentication protocol. An attacker having access to ceph cluster network who is able to alter the message payload was able to bypass signature checks done by cephx protocol. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable.
authentification
A flaw was found in the way ceph mon handles user requests
CVE-2018-10861
8.1 - High
- July 10, 2018
A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph storage pools and corrupt snapshot images. Ceph branches master, mimic, luminous and jewel are believed to be affected.
authentification