{"id":"CVE-2020-25678","aliases":["DEBIAN-CVE-2020-25678","DLA-3629-1","EUVD-2020-18340","GHSA-h22j-342g-797c","MGASA-2021-0126","OESA-2021-1100","RHSA-2021:1452","SUSE-SU-2021:1108-1","SUSE-SU-2021:1472-1","SUSE-SU-2021:1473-1","UBUNTU-CVE-2020-25678","USN-4998-1","openSUSE-SU-2021:0544-1","openSUSE-SU-2024:11652-1"],"status":"published","title":"A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in...","description":"A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in clear text. This can be found by searching the mgr logs for grafana and dashboard, with passwords visible.","severity":{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00256,"percentile":0.17344,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-312"],"published":"2021-01-08T17:59:34Z","modified":"2026-10-26T12:02:40Z","fixes":[{"ecosystem":"Debian:12","package":"ceph","fixed_in":["14.2.18-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ceph","fixed_in":["14.2.18-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ceph","fixed_in":["14.2.18-1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS","package":"ceph","fixed_in":["12.2.8-12.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"ceph","fixed_in":["12.2.8-12.oe1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"ceph","fixed_in":["15.2.12-0ubuntu0.20.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.18-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.18-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.18-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.11+dfsg1-2.1+deb10u1"}]}],"versions":["12.2.11+dfsg1-2.1"],"bundled":12},{"source":"osv","ecosystem":"Mageia:8","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.9-1.mga8"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.8-12.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.8-12.oe1"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph-grafana-dashboards","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph-mgr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph-mgr-dashboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph-mgr-diskprediction-local","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph-mgr-k8sevents","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph-mgr-rook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph-mon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"libcephfs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"libcephfs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"librados-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"librados2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"libradospp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"libradosstriper1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"librbd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"librbd1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"librgw-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"librgw2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"python-ceph-argparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"python-cephfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"python-rados","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"python-rbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"python-rgw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph-osd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph-ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.49.2-1.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph-fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph-mds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph-radosgw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"libtcmu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.2-2.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"rbd-mirror","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"rbd-nbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"tcmu-runner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.2-2.el7cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-base-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-common-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-fuse-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-grafana-dashboards","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-mds-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-mgr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-mgr-dashboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-mgr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-mgr-diskprediction-local","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-mgr-k8sevents","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-mgr-rook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-mon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-mon-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-osd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-radosgw-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-test-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"gperftools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.3-3.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"gperftools-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.3-3.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"gperftools-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.3-3.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"gperftools-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.3-3.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"libcephfs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"libcephfs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"libcephfs2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"librados-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"librados-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"librados2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"librados2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"libradospp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"libradosstriper1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"libradosstriper1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"librbd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"librbd1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"librbd1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"librgw-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"librgw2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"librgw2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"python3-ceph-argparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"python3-cephfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"python3-cephfs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"python3-rados","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"python3-rados-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"python3-rbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"python3-rbd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"python3-rgw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"python3-rgw-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"rbd-fuse-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"rbd-mirror-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"rbd-nbd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-osd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.49.2-1.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-mds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-radosgw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"libtcmu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.2-3.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"rbd-mirror","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"rbd-nbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-147.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"tcmu-runner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.2-3.el8cp"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.9.83+g4275378de0-3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.9.83+g4275378de0-3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"deepsea","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.35+git.0.5a1dc9fe-3.34.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.20.402+g6aa76c6815-3.60.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.20.402+g6aa76c6815-3.60.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.20.402+g6aa76c6815-3.60.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.20.402+g6aa76c6815-3.60.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.20.402+g6aa76c6815-3.60.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.0","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.20.402+g6aa76c6815-3.60.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.20.402+g6aa76c6815-3.60.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server 4.0","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.20.402+g6aa76c6815-3.60.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.20.402+g6aa76c6815-3.60.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.12-0ubuntu0.20.04.1"}]}],"versions":["14.2.2-0ubuntu3","14.2.2-0ubuntu4","14.2.4-0ubuntu1","14.2.4-0ubuntu2","14.2.4-0ubuntu3","15.1.0-0ubuntu2","15.1.0-0ubuntu3","15.1.1-0ubuntu1","15.2.0-0ubuntu1","15.2.0-0ubuntu2","15.2.1-0ubuntu1","15.2.1-0ubuntu2","15.2.3-0ubuntu0.20.04.1","15.2.3-0ubuntu0.20.04.2","15.2.5-0ubuntu0.20.04.1","15.2.7-0ubuntu0.20.04.1","15.2.7-0ubuntu0.20.04.2","15.2.8-0ubuntu0.20.04.1","15.2.11-0ubuntu0.20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.12-0ubuntu0.20.04.1"}]}],"versions":["14.2.2-0ubuntu3","14.2.2-0ubuntu4","14.2.4-0ubuntu1","14.2.4-0ubuntu2","14.2.4-0ubuntu3","15.1.0-0ubuntu2","15.1.0-0ubuntu3","15.1.1-0ubuntu1","15.2.0-0ubuntu1","15.2.0-0ubuntu2","15.2.1-0ubuntu1","15.2.1-0ubuntu2","15.2.3-0ubuntu0.20.04.1","15.2.3-0ubuntu0.20.04.2","15.2.5-0ubuntu0.20.04.1","15.2.7-0ubuntu0.20.04.1","15.2.7-0ubuntu0.20.04.2","15.2.8-0ubuntu0.20.04.1","15.2.11-0ubuntu0.20.04.2"],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.9.83+g4275378de0-lp152.2.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"ceph-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.9.83+g4275378de0-lp152.2.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.2.6.463+g22e7612f9ad-1.1"}]}],"bundled":4}],"products":[{"vendor":"ceph","product":"ceph"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"redhat","product":"ceph"},{"vendor":"redhat","product":"ceph_storage"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1892109","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","fix","report"]},{"url":"https://tracker.ceph.com/issues/37503","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix","article"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OQTBKVXVYP7GPQNZ5VASOIJHMLK7727M/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202105-39","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/10/msg00034.html","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-25678","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OQTBKVXVYP7GPQNZ5VASOIJHMLK7727M/"},{"url":"https://access.redhat.com/errata/RHSA-2021:1452","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-25678","tags":["report"]},{"url":"https://github.com/advisories/GHSA-h22j-342g-797c"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-25678","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0126.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=28538","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/OQTBKVXVYP7GPQNZ5VASOIJHMLK7727M/","tags":["web"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1100","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1831779","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1831798","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1859257","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1867717","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1873881","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1875346","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1875777","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1876827","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1881304","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1882561","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1884469","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1885441","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1888630","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1892265","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1892824","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1901543","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1901865","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1901973","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1903990","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1908910","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1909176","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1912454","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1912538","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1915478","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1916045","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1917374","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1917687","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1919102","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1919123","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1919201","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1919294","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1919416","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1919956","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1921829","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1922998","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1925247","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1925350","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1925650","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1925651","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1927719","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1928019","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1928268","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1929064","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1929714","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1930164","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1931365","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1931441","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1931494","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1932175","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1932780","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1932848","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1933963","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1936210","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1936647","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1937088","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1937997","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1938105","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1938669","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1939766","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1942142","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1943471","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1944611","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1947142","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1949166","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1452.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-25678","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3139","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3139","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3139","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211108-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1172926","tags":["report"]},{"url":"https://bugzilla.suse.com/1176390","tags":["report"]},{"url":"https://bugzilla.suse.com/1176489","tags":["report"]},{"url":"https://bugzilla.suse.com/1176679","tags":["report"]},{"url":"https://bugzilla.suse.com/1176828","tags":["report"]},{"url":"https://bugzilla.suse.com/1177360","tags":["report"]},{"url":"https://bugzilla.suse.com/1177857","tags":["report"]},{"url":"https://bugzilla.suse.com/1178837","tags":["report"]},{"url":"https://bugzilla.suse.com/1178860","tags":["report"]},{"url":"https://bugzilla.suse.com/1178905","tags":["report"]},{"url":"https://bugzilla.suse.com/1178932","tags":["report"]},{"url":"https://bugzilla.suse.com/1179569","tags":["report"]},{"url":"https://bugzilla.suse.com/1179997","tags":["report"]},{"url":"https://bugzilla.suse.com/1182766","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-27839","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211472-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1145463","tags":["report"]},{"url":"https://bugzilla.suse.com/1174466","tags":["report"]},{"url":"https://bugzilla.suse.com/1177200","tags":["report"]},{"url":"https://bugzilla.suse.com/1178016","tags":["report"]},{"url":"https://bugzilla.suse.com/1178216","tags":["report"]},{"url":"https://bugzilla.suse.com/1178235","tags":["report"]},{"url":"https://bugzilla.suse.com/1178657","tags":["report"]},{"url":"https://bugzilla.suse.com/1180118","tags":["report"]},{"url":"https://bugzilla.suse.com/1180594","tags":["report"]},{"url":"https://bugzilla.suse.com/1181183","tags":["report"]},{"url":"https://bugzilla.suse.com/1181378","tags":["report"]},{"url":"https://bugzilla.suse.com/1181665","tags":["report"]},{"url":"https://bugzilla.suse.com/1183074","tags":["report"]},{"url":"https://bugzilla.suse.com/1183487","tags":["report"]},{"url":"https://bugzilla.suse.com/1183600","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20288","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211473-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-25678","tags":["report"]},{"url":"https://github.com/ceph/ceph/pull/38479","tags":["report"]},{"url":"https://github.com/ceph/ceph/pull/38620","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4998-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-27781","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-27839","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3509","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3524","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3531","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-20288","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/SNSWJAZ3F5NDFCU63NISQ76JHRYOI25U/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25660","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-27781","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-25678","description":"A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in clear text. This can be found by searching the mgr logs for grafana and dashboard, with passwords visible.","status":"published","published":"2021-01-08T17:59:34Z","modified":"2025-02-13T16:27:41.662Z","cwes":["CWE-312"],"updated_at":"2026-11-02T14:35:48.854892Z"}],"euvd":[{"id":"EUVD-2020-18340","description":"A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in clear text. This can be found by searching the mgr logs for grafana and dashboard, with passwords visible.","status":"published","published":"2021-01-08T17:59:34Z","modified":"2025-02-13T16:27:41Z","cvss":[{"version":"","score":0,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"none"}],"updated_at":"2026-11-03T00:03:53.290549Z"}],"ghsa":[{"id":"GHSA-h22j-342g-797c","title":"A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in...","description":"A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in clear text. This can be found by searching the mgr logs for grafana and dashboard, with passwords visible.","status":"published","published":"2022-05-24T17:38:19Z","modified":"2023-11-01T05:04:01Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-312"],"updated_at":"2026-11-02T14:54:48.673101Z"}],"nvd":[{"id":"CVE-2020-25678","description":"A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in clear text. This can be found by searching the mgr logs for grafana and dashboard, with passwords visible.","status":"published","published":"2021-01-08T18:15:13.293Z","modified":"2026-06-17T03:07:06.81Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-312"],"updated_at":"2026-11-02T14:06:28.892872Z"}],"osv":[{"id":"CVE-2020-25678","description":"A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in clear text. This can be found by searching the mgr logs for grafana and dashboard, with passwords visible.","status":"published","published":"2021-01-08T18:15:13.293Z","modified":"2026-10-24T10:31:00.971899572Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:15.879068Z"},{"id":"DEBIAN-CVE-2020-25678","description":"A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in clear text. This can be found by searching the mgr logs for grafana and dashboard, with passwords visible.","status":"published","published":"2021-01-08T18:15:13.293Z","modified":"2026-10-26T12:02:40.552788575Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:33.729655Z"},{"id":"OESA-2021-1100","title":"ceph security update","description":"Ceph is a massively scalable, open-source, distributed storage system that runs on commodity hardware and delivers object, block and file system storage.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in clear text. This can be found by searching the mgr logs for grafana and dashboard, with passwords visible.(CVE-2020-25678)","status":"published","published":"2021-04-07T11:04:20Z","modified":"2026-08-18T01:15:18.643035458Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"RHSA-2021:1452","title":"Red Hat Security Advisory: Red Hat Ceph Storage security, bug fix, and enhancement Update","status":"published","published":"2024-09-16T05:20:42Z","modified":"2026-06-28T10:43:40Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"UBUNTU-CVE-2020-25678","description":"A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in clear text. This can be found by searching the mgr logs for grafana and dashboard, with passwords visible.","status":"published","published":"2021-01-08T18:15:00Z","modified":"2026-04-22T12:35:51.523627Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:23.905183Z"},{"id":"DLA-3629-1","title":"ceph - security update","status":"published","published":"2023-10-23T00:00:00Z","modified":"2026-03-09T01:20:33.777283Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"MGASA-2021-0126","title":"Updated ceph packages fix security vulnerabilities","description":"A flaw was found in Ceph where Ceph stores mgr module passwords in clear text.\nThis issue can be found by searching the mgr logs for Grafana and dashboard\nwith passwords visible. The highest threat from this vulnerability is to\nconfidentiality (CVE-2020-25678).\n\nA flaw was found in ceph-dashboard. The JSON Web Token (JWT) used for user\nauthentication is stored by the frontend application in the browser’s\nlocalStorage which is potentially vulnerable to attackers via XSS attacks. The\nhighest threat from this vulnerability is to data confidentiality and\nintegrity (CVE-2020-27839).\n","status":"published","published":"2021-03-12T01:25:47Z","modified":"2026-04-16T04:43:11.662743224Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2021:0544-1","title":"Security update for ceph","description":"This update for ceph fixes the following issues:\n\n- ceph was updated to to 15.2.9\n- cephadm: fix 'inspect' and 'pull' (bsc#1182766)\n- CVE-2020-27839: mgr/dashboard: Use secure cookies to store JWT Token (bsc#1179997)\n- CVE-2020-25678: Do not add sensitive information in Ceph log files (bsc#1178905)\n- mgr/orchestrator: Sort 'ceph orch device ls' by host (bsc#1172926)\n- mgr/dashboard: enable different URL for users of browser to Grafana (bsc#1176390, bsc#1176679)\n- mgr/cephadm: lock multithreaded access to OSDRemovalQueue (bsc#1176489)\n- cephadm: command_unit: call systemctl with verbose=True (bsc#1176828)\n- cephadm: silence 'Failed to evict container' log msg (bsc#1177360)\n- mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails (bsc#1177857)\n- rgw: cls/user: set from_index for reset stats calls (bsc#1178837)\n- mgr/dashboard: Disable TLS 1.0 and 1.1 (bsc#1178860)\n- cephadm: reference the last local image by digest (bsc#1178932, bsc#1179569)\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2021-04-12T04:05:20Z","modified":"2026-02-04T03:00:08.817966Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2024:11652-1","title":"ceph-16.2.6.463+g22e7612f9ad-1.1 on GA media","description":"These are all security issues fixed in the ceph-16.2.6.463+g22e7612f9ad-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:15:38.320101Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2021:1108-1","title":"Security update for ceph","description":"This update for ceph fixes the following issues:\n\n- ceph was updated to to 15.2.9\n- cephadm: fix 'inspect' and 'pull' (bsc#1182766)\n- CVE-2020-27839: mgr/dashboard: Use secure cookies to store JWT Token (bsc#1179997)\n- CVE-2020-25678: Do not add sensitive information in Ceph log files (bsc#1178905)\n- mgr/orchestrator: Sort 'ceph orch device ls' by host (bsc#1172926)\n- mgr/dashboard: enable different URL for users of browser to Grafana (bsc#1176390, bsc#1176679)\n- mgr/cephadm: lock multithreaded access to OSDRemovalQueue (bsc#1176489)\n- cephadm: command_unit: call systemctl with verbose=True (bsc#1176828)\n- cephadm: silence 'Failed to evict container' log msg (bsc#1177360)\n- mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails (bsc#1177857)\n- rgw: cls/user: set from_index for reset stats calls (bsc#1178837)\n- mgr/dashboard: Disable TLS 1.0 and 1.1 (bsc#1178860)\n- cephadm: reference the last local image by digest (bsc#1178932, bsc#1179569)\n","status":"published","published":"2021-04-08T09:48:59Z","modified":"2026-02-04T02:36:27.795158Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2021:1472-1","title":"Security update for ceph, deepsea","description":"This update for ceph, deepsea fixes the following issues:\n\n- ceph was updated to 14.2.20-402-g6aa76c6815:\n    * CVE-2021-20288: Fixed unauthorized global_id reuse (bsc#1183074).\n    * CVE-2020-25678: Do not add sensitive information in Ceph log files (bsc#1178905).\n    * CVE-2020-27839: Use secure cookies to store JWT Token (bsc#1179997). \n    * mgr/dashboard: prometheus alerting: add some leeway for package drops and errors (bsc#1145463) \n    * mon: have 'mon stat' output json as well (bsc#1174466) \n    * rpm: ceph-mgr-dashboard recommends python3-saml on SUSE (bsc#1177200) \n    * mgr/dashboard: Display a warning message in Dashboard when debug mode is enabled (bsc#1178235) \n    * rgw: cls/user: set from_index for reset stats calls (bsc#1178837) \n    * mgr/dashboard: Disable TLS 1.0 and 1.1 (bsc#1178860)\n    * bluestore: provide a different name for fallback allocator (bsc#1180118) \n    * test/run-cli-tests: use cram from github (bsc#1181378) \n    * mgr/dashboard: fix 'Python2 Cookie module import fails on Python3' (bsc#1183487) \n    * common: make ms_bind_msgr2 default to 'false' (bsc#1180594) \n\n- deapsea was updated to 0.9.35\n    * osd: add method to zap simple osds (bsc#1178657, bsc#1178216)\n    * upgrade to cephadm: fix Drive Group generation (bsc#1181665)\n    * Rework config change detection to handle global.conf correctly (bsc#1181183)\n    * Use -i to pass credentials to `ceph dashboard` commands (bsc#1183600)\n","status":"published","published":"2021-05-04T06:56:39Z","modified":"2026-02-04T02:26:01.601395Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:1473-1","title":"Security update for ceph","description":"This update for ceph fixes the following issues:\n\n- ceph was updated to 14.2.20-402-g6aa76c6815:\n    * CVE-2021-20288: Fixed unauthorized global_id reuse (bsc#1183074).\n    * CVE-2020-25678: Do not add sensitive information in Ceph log files (bsc#1178905).\n    * CVE-2020-27839: Use secure cookies to store JWT Token (bsc#1179997). \n    * mgr/dashboard: prometheus alerting: add some leeway for package drops and errors (bsc#1145463) \n    * mon: have 'mon stat' output json as well (bsc#1174466) \n    * rpm: ceph-mgr-dashboard recommends python3-saml on SUSE (bsc#1177200) \n    * mgr/dashboard: Display a warning message in Dashboard when debug mode is enabled (bsc#1178235) \n    * rgw: cls/user: set from_index for reset stats calls (bsc#1178837) \n    * mgr/dashboard: Disable TLS 1.0 and 1.1 (bsc#1178860)\n    * bluestore: provide a different name for fallback allocator (bsc#1180118) \n    * test/run-cli-tests: use cram from github (bsc#1181378) \n    * mgr/dashboard: fix 'Python2 Cookie module import fails on Python3' (bsc#1183487) \n    * common: make ms_bind_msgr2 default to 'false' (bsc#1180594) \n","status":"published","published":"2021-05-04T06:58:05Z","modified":"2026-02-04T02:23:07.244902Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"USN-4998-1","title":"ceph vulnerabilities","description":"It was discovered that in some situations Ceph logged passwords from the\nmgr module in clear text. An attacker could use this to expose sensitive\ninformation. (CVE-2020-25678)\n\nGoutham Pacha Ravi, Jahson Babel, and John Garbutt discovered that user\ncredentials in Ceph could be manipulated in certain environments. An\nattacker could use this to gain unintended access. (CVE-2020-27781)\n\nIt was discovered that the Ceph dashboard was susceptible to a cross-site\nscripting attack. An attacker could use this to expose sensitive\ninformation or gain unintended access. (CVE-2020-27839)\n\nIt was discovered that Ceph contained an authentication flaw, leading to\nkey reuse. An attacker could use this to cause a denial of service or\npossibly impersonate another user. (CVE-2021-20288)\n\nSergey Bobrov discovered that the Ceph dashboard was susceptible to a\ncross-site scripting attack. An attacker could use this to expose sensitive\ninformation or gain unintended access. (CVE-2021-3509)\n\nSergey Bobrov discovered that Ceph's RadosGW (Ceph Object Gateway) allowed\nthe injection of HTTP headers in responses to CORS requests. An attacker\ncould use this to violate system integrity. (CVE-2021-3524)\n\nIt was discovered that Ceph's RadosGW (Ceph Object Gateway) did not\nproperly handle GET requests for swift URLs in some situations, leading to\nan application crash. An attacker could use this to cause a denial of\nservice. (CVE-2021-3531)\n","status":"published","published":"2021-06-25T02:38:50Z","modified":"2026-04-22T10:15:26.237909Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}