Description
It was found Ceph versions before 13.2.4 that authenticated ceph users with read only permissions could steal dm-crypt encryption keys used in ceph disk encryption.
References (8)
Core 8
Core References
Mailing List, Third Party Advisory mailing-list
x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2019/03/msg00002.html
Issue Tracking, Patch, Third Party Advisory x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14662
Vendor Advisory x_refsource_misc
https://ceph.com/releases/13-2-4-mimic-released
Mailing List, Third Party Advisory vendor-advisory
x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00100.html
Third Party Advisory vendor-advisory
x_refsource_ubuntu
https://usn.ubuntu.com/4035-1/
Third Party Advisory vendor-advisory
x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:2538
Third Party Advisory vendor-advisory
x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:2541
Mailing List, Third Party Advisory mailing-list
x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2021/08/msg00013.html
Scores
CVSS v3
5.7
EPSS
0.0006
EPSS Percentile
19.0%
Attack Vector
ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Details
CWE
CWE-285
CWE-732
Status
published
Products (10)
canonical/ubuntu_linux
16.04
canonical/ubuntu_linux
18.10
canonical/ubuntu_linux
19.04
debian/debian_linux
8.0
debian/debian_linux
9.0
opensuse/leap
15.0
redhat/ceph
< 13.2.4
redhat/ceph_storage
2.0
redhat/ceph_storage
3.0
redhat/enterprise_linux_server
7.0
Published
Jan 15, 2019
Tracked Since
Feb 18, 2026