CVE-2018-16889

{"containers": {"cna": {"affected": [{"product": "ceph", "vendor": "The Ceph Project", "versions": [{"status": "affected", "version": "up to v13.2.4"}]}], "datePublic": "2019-01-28T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption key information in log files via plaintext. Versions up to v13.2.4 are vulnerable."}], "metrics": [{"cvssV3_0": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-532", "description": "CWE-532", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2019-08-21T17:06:09.000Z", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"name": "106528", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/106528"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16889"}, {"name": "USN-4035-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "https://usn.ubuntu.com/4035-1/"}, {"name": "RHSA-2019:2538", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2019:2538"}, {"name": "RHSA-2019:2541", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2019:2541"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T10:39:57.643Z"}, "title": "CVE Program Container", "references": [{"name": "106528", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/106528"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16889"}, {"name": "USN-4035-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU", "x_transferred"], "url": "https://usn.ubuntu.com/4035-1/"}, {"name": "RHSA-2019:2538", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2019:2538"}, {"name": "RHSA-2019:2541", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2019:2541"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2018-16889", "datePublished": "2019-01-28T14:00:00.000Z", "dateReserved": "2018-09-11T00:00:00.000Z", "dateUpdated": "2024-08-05T10:39:57.643Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "ceph", "vendor": "The Ceph Project", "versions": [{"status": "affected", "version": "up to v13.2.4"}]}], "source": "secalert@redhat.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:ceph:*:*:*:*:*:*:*:*", "matchCriteriaId": "7AA1712C-B75C-40C0-8001-B1237B80E061", "versionEndIncluding": "13.2.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption key information in log files via plaintext. Versions up to v13.2.4 are vulnerable."}, {"lang": "es", "value": "Ceph no sanea de manera correcta las claves de cifrado en registros de depuraci\u00f3n para autenticaciones v4. Esto resulta en el filtrado de informaci\u00f3n sobre las claves de cifrado en los archivos de registro mediante texto plano. Las versiones hasta la v13.2.4 son vulnerables."}], "id": "CVE-2018-16889", "lastModified": "2026-06-17T01:45:00.287", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "secalert@redhat.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-01-28T14:29:00.220", "references": [{"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "http://www.securityfocus.com/bid/106528"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2019:2538"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2019:2541"}, {"source": "secalert@redhat.com", "tags": ["Exploit", "Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16889"}, {"source": "secalert@redhat.com", "url": "https://usn.ubuntu.com/4035-1/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "http://www.securityfocus.com/bid/106528"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://access.redhat.com/errata/RHSA-2019:2538"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://access.redhat.com/errata/RHSA-2019:2541"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16889"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://usn.ubuntu.com/4035-1/"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-532"}], "source": "secalert@redhat.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-312"}], "source": "nvd@nist.gov", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2019:2538", "cpe": "cpe:/a:redhat:ceph_storage:3::el7", "package": "ceph-2:12.2.12-45.el7cp", "product_name": "Red Hat Ceph Storage 3.3", "release_date": "2019-08-21T00:00:00Z"}, {"advisory": "RHSA-2019:2538", "cpe": "cpe:/a:redhat:ceph_storage:3::el7", "package": "ceph-ansible-0:3.2.24-1.el7cp", "product_name": "Red Hat Ceph Storage 3.3", "release_date": "2019-08-21T00:00:00Z"}, {"advisory": "RHSA-2019:2538", "cpe": "cpe:/a:redhat:ceph_storage:3::el7", "package": "ceph-iscsi-config-0:2.6-19.el7cp", "product_name": "Red Hat Ceph Storage 3.3", "release_date": "2019-08-21T00:00:00Z"}, {"advisory": "RHSA-2019:2538", "cpe": "cpe:/a:redhat:ceph_storage:3::el7", "package": "cephmetrics-0:2.0.6-1.el7cp", "product_name": "Red Hat Ceph Storage 3.3", "release_date": "2019-08-21T00:00:00Z"}, {"advisory": "RHSA-2019:2538", "cpe": "cpe:/a:redhat:ceph_storage:3::el7", "package": "libntirpc-0:1.7.4-1.el7cp", "product_name": "Red Hat Ceph Storage 3.3", "release_date": "2019-08-21T00:00:00Z"}, {"advisory": "RHSA-2019:2538", "cpe": "cpe:/a:redhat:ceph_storage:3::el7", "package": "nfs-ganesha-0:2.7.4-10.el7cp", "product_name": "Red Hat Ceph Storage 3.3", "release_date": "2019-08-21T00:00:00Z"}, {"advisory": "RHSA-2019:2538", "cpe": "cpe:/a:redhat:ceph_storage:3::el7", "package": "python-crypto-0:2.6.1-16.el7ost", "product_name": "Red Hat Ceph Storage 3.3", "release_date": "2019-08-21T00:00:00Z"}, {"advisory": "RHSA-2019:2541", "cpe": "cpe:/a:redhat:ceph_storage:3::ubuntu16.04", "product_name": "Red Hat Ceph Storage 3 for Ubuntu", "release_date": "2019-08-21T00:00:00Z"}], "bugzilla": {"description": "ceph: debug logging for v4 auth does not sanitize encryption keys", "id": "1665334", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1665334"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "status": "verified"}, "cwe": "CWE-20->CWE-312->CWE-200", "details": ["Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption key information in log files via plaintext. Versions up to v13.2.4 are vulnerable.", "It was found that Ceph RGW did not properly sanitize encryption keys in debug logging for v4 auth. Encryption keys could be inadvertently disclosed when sharing debug logs."], "name": "CVE-2018-16889", "package_state": [{"cpe": "cpe:/a:redhat:ceph_storage:2", "fix_state": "Not affected", "package_name": "ceph", "product_name": "Red Hat Ceph Storage 2"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "ceph-common", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "ceph", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:rhev_hypervisor:4", "fix_state": "Not affected", "package_name": "redhat-virtualization-host", "product_name": "Red Hat Virtualization 4"}], "public_date": "2019-01-10T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2018-16889\nhttps://nvd.nist.gov/vuln/detail/CVE-2018-16889"], "threat_severity": "Moderate"}

{}