CVE-2018-16889CWE-532

Ceph does not properly sanitize encryption keys in debug logging for v4 auth

Medium · published January 28, 2019

CVSS v3.0
5.5
EPSS
1%
Percentile
44.4
In the wild
Unconfirmed
What it is

Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption key information in log files via plaintext. Versions up to v13.2.4 are vulnerable.

The record
Technical detail
CVSS v3.0
5.5 · MEDIUM
Vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00536 · 44.4th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2019-01-28T14:00Z
EPSS history
Timeline
  • 28 JAN 14:00Z
    Ceph does not properly sanitize encryption keys in debug logging for v4 auth
    cvelistv5