CVE-2015-3010: ceph-deploy Weak Permissions Vulnerability
Summary
CVE-2015-3010: ceph-deploy before 1.5.23 uses weak permissions (644) for ceph/ceph.client.admin.keyring, which allows local users to obtain sensitive information by reading the file. Affects ceph-deploy across 2 version ranges.
< 1.5.23
< eee56770393bf19ed2dd5389226c6190c08dee3f
Fixed in eee56770393bf19ed2dd5389226c6190c08dee3f. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ceph-deploy is a tool used for deploying Ceph clusters. It is designed to simplify the process of setting up and managing Ceph storage systems. The tool allows users to deploy Ceph on multiple nodes and configure them as monitors, OSDs, and MDSs. It provides a convenient way to automate the deployment process and handle various administrative tasks. However, ceph-deploy versions prior to 1.5.23 suffer from a vulnerability that results in weak permissions for the ceph/ceph.client.admin.keyring file.
Vulnerability Detail
The vulnerability in ceph-deploy versions before 1.5.23 arises from the use of weak permissions (644) for the ceph/ceph.client.admin.keyring file. This file contains sensitive information, including the keyring for the Ceph admin user. Local users with read access to the file can obtain this sensitive information, potentially leading to unauthorized access and compromise of the Ceph cluster. The weak permissions make it easier for an attacker to exploit the vulnerability and gain access to the keyring file.
How To Fix
Minimum fixed version
eee56770393bf19ed2dd5389226c6190c08dee3f
This is the first release that contains the fix.
pip install --upgrade "ceph-deploy==eee56770393bf19ed2dd5389226c6190c08dee3f"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the fixed version of ceph-deploy.
Conclusion
The vulnerability in ceph-deploy versions prior to 1.5.23 allows local users to obtain sensitive information by reading the ceph/ceph.client.admin.keyring file. Upgrading to the fixed version (1.5.23 or later) is recommended to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for ceph-deploy →
FAQ
ceph-deploy is a tool used for deploying Ceph clusters. It simplifies the process of setting up and managing Ceph storage systems.
The vulnerability allows local users to obtain sensitive information by reading the ceph/ceph.client.admin.keyring file, potentially leading to unauthorized access and compromise of the Ceph cluster.
To fix this vulnerability, upgrade to ceph-deploy version 1.5.23 or later, which includes the necessary fix for proper permissions on the keyring file.
There are no specific workarounds mentioned for this vulnerability. Upgrading to the fixed version is the recommended solution.
For more information, you can refer to the vulnerability details in the Open Source Vulnerability format (PYSEC-2015-2) or the associated CVE identifier (CVE-2015-3010).
Related vulnerabilities
Recent vulnerabilities recorded for ceph-deploy.
