{"id":"CVE-2018-16889","aliases":["DEBIAN-CVE-2018-16889","EUVD-2018-8677","GHSA-2xfm-mgc4-j8fx","RHSA-2019:2538","SUSE-SU-2019:0499-1","SUSE-SU-2019:2049-1","SUSE-SU-2019:2364-1","UBUNTU-CVE-2018-16889","USN-4035-1","openSUSE-SU-2024:10676-1"],"status":"published","title":"Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the...","description":"Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption key information in log files via plaintext. Versions up to v13.2.4 are vulnerable.","severity":{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00536,"percentile":0.45472,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-200","CWE-312","CWE-532"],"published":"2019-01-28T00:00:00Z","modified":"2026-10-24T10:30:49Z","fixes":[{"ecosystem":"Debian:12","package":"ceph","fixed_in":["12.2.11+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ceph","fixed_in":["12.2.11+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ceph","fixed_in":["12.2.11+dfsg1-1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"ceph","fixed_in":["12.2.12+git.1568024032.02236657ca-2.39.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"ceph","fixed_in":["12.2.12+git.1568024032.02236657ca-2.39.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"ceph","fixed_in":["12.2.12+git.1568024032.02236657ca-2.39.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"ceph","fixed_in":["12.2.12+git.1568024032.02236657ca-2.39.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 5","package":"ceph","fixed_in":["12.2.12+git.1568024032.02236657ca-2.39.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"ceph","fixed_in":["10.2.11-0ubuntu0.16.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"ceph","fixed_in":["12.2.11-0ubuntu0.18.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.11+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.11+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.11+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-45.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-45.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-45.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-45.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-mgr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-45.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-mon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-45.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-45.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-45.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"libcephfs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-45.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"libcephfs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-45.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"librados-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-45.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"librados2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-45.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"libradosstriper1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-45.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"librbd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-45.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"librbd1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-45.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"librgw-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-45.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"librgw2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-45.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"python-cephfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-45.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"python-rados","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-45.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"python-rbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-45.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"python-rgw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-45.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-osd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-45.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.24-1.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-45.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-iscsi-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6-19.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-mds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-45.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-radosgw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-45.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"cephmetrics","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.6-1.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"cephmetrics-ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.6-1.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"libntirpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.4-1.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"libntirpc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.4-1.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"nfs-ganesha","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.4-10.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"nfs-ganesha-ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.4-10.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"nfs-ganesha-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.4-10.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"nfs-ganesha-rgw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.4-10.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"python-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.1-16.el7ost"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"python-crypto-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.1-16.el7ost"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"python2-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.1-16.el7ost"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"rbd-mirror","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-45.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.10+git.1549630712.bb089269ea-2.27.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.10+git.1549630712.bb089269ea-2.27.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.10+git.1549630712.bb089269ea-2.27.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.10+git.1549630712.bb089269ea-2.27.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.10+git.1549630712.bb089269ea-2.27.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.10+git.1549630712.bb089269ea-2.27.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.10+git.1549630712.bb089269ea-2.27.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.10+git.1549630712.bb089269ea-2.27.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.10+git.1549630712.bb089269ea-2.27.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.1.468+g994fd9e0cc-3.3.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.1.468+g994fd9e0cc-3.3.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.12+git.1568024032.02236657ca-2.39.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.12+git.1568024032.02236657ca-2.39.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.12+git.1568024032.02236657ca-2.39.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.12+git.1568024032.02236657ca-2.39.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.12+git.1568024032.02236657ca-2.39.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2.11-0ubuntu0.16.04.2"}]}],"versions":["0.94.3-0ubuntu2","0.94.5-0ubuntu1","9.2.0-0ubuntu3","9.2.0-0ubuntu4","9.2.0-0ubuntu5","9.2.0-0ubuntu6","10.0.2-0ubuntu1","10.0.3-0ubuntu1","10.0.5-0ubuntu1","10.1.0-0ubuntu1","10.1.1-0ubuntu1","10.1.2-0ubuntu1","10.2.0-0ubuntu0.16.04.1","10.2.0-0ubuntu0.16.04.2","10.2.2-0ubuntu0.16.04.2","10.2.3-0ubuntu0.16.04.2","10.2.5-0ubuntu0.16.04.1","10.2.6-0ubuntu0.16.04.1","10.2.7-0ubuntu0.16.04.1","10.2.9-0ubuntu0.16.04.1","10.2.10-0ubuntu0.16.04.1","10.2.11-0ubuntu0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.11-0ubuntu0.18.04.1"}]}],"versions":["12.2.0-0ubuntu1","12.2.1-0ubuntu1","12.2.2-0ubuntu1","12.2.2-0ubuntu2","12.2.4-0ubuntu1","12.2.4-0ubuntu1.1","12.2.7-0ubuntu0.18.04.1","12.2.8-0ubuntu0.18.04.1","12.2.8-0ubuntu0.18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2.11-0ubuntu0.16.04.2"}]}],"versions":["0.94.3-0ubuntu2","0.94.5-0ubuntu1","9.2.0-0ubuntu3","9.2.0-0ubuntu4","9.2.0-0ubuntu5","9.2.0-0ubuntu6","10.0.2-0ubuntu1","10.0.3-0ubuntu1","10.0.5-0ubuntu1","10.1.0-0ubuntu1","10.1.1-0ubuntu1","10.1.2-0ubuntu1","10.2.0-0ubuntu0.16.04.1","10.2.0-0ubuntu0.16.04.2","10.2.2-0ubuntu0.16.04.2","10.2.3-0ubuntu0.16.04.2","10.2.5-0ubuntu0.16.04.1","10.2.6-0ubuntu0.16.04.1","10.2.7-0ubuntu0.16.04.1","10.2.9-0ubuntu0.16.04.1","10.2.10-0ubuntu0.16.04.1","10.2.11-0ubuntu0.16.04.1"],"bundled":4}],"products":[{"vendor":"ceph","product":"ceph"},{"vendor":"redhat","product":"ceph"},{"vendor":"the ceph project","product":"ceph"}],"references":[{"url":"http://www.securityfocus.com/bid/106528","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16889","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://usn.ubuntu.com/4035-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2538","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2541","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-16889","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-16889","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1665334","tags":["report"]},{"url":"https://github.com/advisories/GHSA-2xfm-mgc4-j8fx"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-16889","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_ceph_storage/3.3/html/release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1337915","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1572933","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1599852","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1627567","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1628309","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1628311","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1631010","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1636136","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1637327","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1639712","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1644321","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1644461","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1644610","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1644847","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1651054","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1656908","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1659611","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1661504","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1666822","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1668478","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1668896","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1668897","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1669838","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1670527","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1670785","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1677269","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1680144","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1680155","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1685253","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1685734","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1686306","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1695850","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1696227","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1696691","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1696880","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1700896","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1701029","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1702091","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1702092","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1702093","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1702097","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1702099","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1702100","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1702732","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1703557","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1704948","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1705258","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1705922","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1708346","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1708650","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1708798","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1709765","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1710855","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1713779","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1714810","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1714814","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1715577","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1715946","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1717135","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1718135","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1718328","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1719023","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1720205","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1720741","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1721165","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1722663","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1722664","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1725521","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1725536","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1732142","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1732706","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1734550","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1739209","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2538.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-14662","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-14662","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-14662","tags":["advisory"]},{"url":"https://ceph.com/releases/13-2-4-mimic-released","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-16846","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-16846","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-16846","tags":["advisory"]},{"url":"https://ceph.com/releases/13-2-4-mimic-released/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-16889","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190499-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1111177","tags":["report"]},{"url":"https://bugzilla.suse.com/1113246","tags":["report"]},{"url":"https://bugzilla.suse.com/1114710","tags":["report"]},{"url":"https://bugzilla.suse.com/1121567","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16889","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192049-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1123360","tags":["report"]},{"url":"https://bugzilla.suse.com/1124957","tags":["report"]},{"url":"https://bugzilla.suse.com/1125080","tags":["report"]},{"url":"https://bugzilla.suse.com/1125899","tags":["report"]},{"url":"https://bugzilla.suse.com/1131984","tags":["report"]},{"url":"https://bugzilla.suse.com/1132396","tags":["report"]},{"url":"https://bugzilla.suse.com/1133139","tags":["report"]},{"url":"https://bugzilla.suse.com/1133461","tags":["report"]},{"url":"https://bugzilla.suse.com/1135030","tags":["report"]},{"url":"https://bugzilla.suse.com/1135219","tags":["report"]},{"url":"https://bugzilla.suse.com/1135221","tags":["report"]},{"url":"https://bugzilla.suse.com/1135388","tags":["report"]},{"url":"https://bugzilla.suse.com/1136110","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3821","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192364-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1149961","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-16889","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4035-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-14662","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-16846","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-3821","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10736","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1759","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1760","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20288","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3509","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3524","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3531","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-16889","description":"Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption key information in log files via plaintext. Versions up to v13.2.4 are vulnerable.","status":"published","published":"2019-01-28T14:00:00Z","modified":"2024-08-05T10:39:57.643Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:35:11.072321Z"}],"euvd":[{"id":"EUVD-2018-8677","description":"Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption key information in log files via plaintext. Versions up to v13.2.4 are vulnerable.","status":"published","published":"2019-01-28T14:00:00Z","modified":"2024-08-05T10:39:57Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T02:39:40.316949Z"}],"ghsa":[{"id":"GHSA-2xfm-mgc4-j8fx","title":"Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the...","description":"Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption key information in log files via plaintext. Versions up to v13.2.4 are vulnerable.","status":"published","published":"2022-05-13T01:50:27Z","modified":"2023-02-13T06:32:01Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200","CWE-532"],"updated_at":"2026-11-02T14:54:06.501947Z"}],"nvd":[{"id":"CVE-2018-16889","description":"Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption key information in log files via plaintext. Versions up to v13.2.4 are vulnerable.","status":"published","published":"2019-01-28T14:29:00.22Z","modified":"2026-06-17T01:45:00.287Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-532","CWE-20","CWE-200","CWE-312"],"updated_at":"2026-11-02T14:04:53.728218Z"}],"osv":[{"id":"CVE-2018-16889","description":"Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption key information in log files via plaintext. Versions up to v13.2.4 are vulnerable.","status":"published","published":"2019-01-28T14:29:00.22Z","modified":"2026-10-24T10:30:49.331493148Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:08.533609Z"},{"id":"DEBIAN-CVE-2018-16889","description":"Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption key information in log files via plaintext. Versions up to v13.2.4 are vulnerable.","status":"published","published":"2019-01-28T14:29:00.22Z","modified":"2026-10-23T18:03:28.80266387Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:30.57382Z"},{"id":"RHSA-2019:2538","title":"Red Hat Security Advisory: Red Hat Ceph Storage 3.3 security, bug fix, and enhancement update","status":"published","published":"2024-09-13T15:12:04Z","modified":"2026-06-29T10:26:06Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:06.0195Z"},{"id":"UBUNTU-CVE-2018-16889","description":"Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption key information in log files via plaintext. Versions up to v13.2.4 are vulnerable.","status":"published","published":"2019-01-28T00:00:00Z","modified":"2026-04-22T11:47:53.350655Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"},{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:17.496046Z"},{"id":"openSUSE-SU-2024:10676-1","title":"ceph-16.2.6.45+g8fda9838398-1.1 on GA media","description":"These are all security issues fixed in the ceph-16.2.6.45+g8fda9838398-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:26:40.49272Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2019:0499-1","title":"Security update for ceph","description":"This update for ceph fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-14662: mon: limit caps allowed to access the config store (bsc#1111177)\n- CVE-2018-16846: rgw: enforce bounds on max-keys/max-uploads/max-parts (bsc#1114710)\n- CVE-2018-16889: rgw: sanitize customer encryption keys from log output in v4 auth (bsc#1121567)\n\nNon-security issue fixed:\n\n- os/bluestore: avoid frequent allocator dump on bluefs rebalance failure (bsc#1113246)\n","status":"published","published":"2019-02-26T15:45:36Z","modified":"2026-02-04T03:34:15.826392Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:2049-1","title":"Security update for ceph","description":"This update for ceph fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-3821: civetweb: fix file descriptor leak (bsc#1125080)\n- CVE-2018-16889: rgw: sanitize customer encryption keys from log output in v4 auth (bsc#1121567)\n\nNon-security issues fixed:\n\n- install grafana dashboards world readable (bsc#1136110)\n- upgrade results in cluster outage (bsc#1132396)\n- ceph status reports 'HEALTH_WARN 3 monitors have not enabled msgr2' (bsc#1124957)\n-  Dashboard: Opening tcmu-runner perf counters results in a 404 (bsc#1135388)\n- RadosGW stopped expiring objects (bsc#1133139)\n- Ceph does not recover when rebuilding every OSD  (bsc#1133461)\n","status":"published","published":"2019-08-05T15:56:32Z","modified":"2026-02-04T04:38:28.880616Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:2364-1","title":"Security update for ceph","description":"This update for ceph to version 12.2.12-594-g02236657ca fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-16889: Fixed missing sanitation of customer encryption keys from log output in v4 auth. (bsc#1121567)\n","status":"published","published":"2019-09-12T09:23:16Z","modified":"2026-02-04T04:01:20.696549Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"USN-4035-1","title":"ceph vulnerabilities","description":"It was discovered that Ceph incorrectly handled read only permissions. An\nauthenticated attacker could use this issue to obtain dm-crypt encryption\nkeys. This issue only affected Ubuntu 16.04 LTS. (CVE-2018-14662)\n\nIt was discovered that Ceph incorrectly handled certain OMAPs holding\nbucket indices. An authenticated attacker could possibly use this issue to\ncause a denial of service. This issue only affected Ubuntu 16.04 LTS.\n(CVE-2018-16846)\n\nIt was discovered that Ceph incorrectly sanitized certain debug logs. A\nlocal attacker could possibly use this issue to obtain encryption key\ninformation. This issue was only addressed in Ubuntu 18.10 and Ubuntu\n19.04. (CVE-2018-16889)\n\nIt was discovered that Ceph incorrectly handled certain civetweb requests.\nA remote attacker could possibly use this issue to consume resources,\nleading to a denial of service. This issue only affected Ubuntu 18.10 and\nUbuntu 19.04. (CVE-2019-3821)\n","status":"published","published":"2019-06-25T11:40:06Z","modified":"2026-04-22T09:58:04.824743Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}