Vulnerabilities > Redhat > Ceph > 0.39
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-05-26 | CVE-2020-27839 | Insufficiently Protected Credentials vulnerability in Redhat Ceph A flaw was found in ceph-dashboard. | 3.5 |
| 2021-05-18 | CVE-2021-3531 | Reachable Assertion vulnerability in multiple products A flaw was found in the Red Hat Ceph Storage RGW in versions before 14.2.21. | 5.3 |
| 2021-05-17 | CVE-2021-3524 | Injection vulnerability in multiple products A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in versions before 14.2.21. | 6.5 |
| 2021-01-08 | CVE-2020-25678 | Cleartext Storage of Sensitive Information vulnerability in multiple products A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in clear text. | 4.4 |
| 2020-12-18 | CVE-2020-27781 | Insufficiently Protected Credentials vulnerability in multiple products User credentials can be manipulated and stolen by Native CephFS consumers of OpenStack Manila, resulting in potential privilege escalation. | 7.1 |
| 2020-11-23 | CVE-2020-25660 | Authentication Bypass by Capture-replay vulnerability in multiple products A flaw was found in the Cephx authentication protocol in versions before 15.2.6 and before 14.2.14, where it does not verify Ceph clients correctly and is then vulnerable to replay attacks in Nautilus. | 8.8 |
| 2019-01-28 | CVE-2018-16889 | Information Exposure Through Log Files vulnerability in Redhat Ceph Ceph does not properly sanitize encryption keys in debug logging for v4 auth. | 7.5 |
| 2019-01-15 | CVE-2018-14662 | Improper Authorization vulnerability in multiple products It was found Ceph versions before 13.2.4 that authenticated ceph users with read only permissions could steal dm-crypt encryption keys used in ceph disk encryption. | 2.7 |
| 2019-01-15 | CVE-2018-16846 | Allocation of Resources Without Limits or Throttling vulnerability in multiple products It was found in Ceph versions before 13.2.4 that authenticated ceph RGW users can cause a denial of service against OMAPs holding bucket indices. | 4.0 |
| 2018-07-31 | CVE-2016-8626 | Improper Input Validation vulnerability in Redhat products A flaw was found in Red Hat Ceph before 0.94.9-8. | 6.5 |