GitHub Advisory DatabaseGHSA-9W4F-3V37-6F75ceph-deploy allows local users to obtain sensitive information by reading the file
2.1 Low
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:L/Au:N/C:P/I:N/A:N
5.9 Medium
AI Score
Confidence
Low
0.0004 Low
EPSS
Percentile
5.1%
ceph-deploy before 1.5.23 uses weak permissions (644) for ceph/ceph.client.admin.keyring, which allows local users to obtain sensitive information by reading the file.
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| ceph-deploy | lt | 1.5.23 |
References
lists.fedoraproject.org/pipermail/package-announce/2015-April/155576.html
lists.fedoraproject.org/pipermail/package-announce/2015-April/155631.html
rhn.redhat.com/errata/RHSA-2015-1092.html
www.openwall.com/lists/oss-security/2015/04/09/11
www.openwall.com/lists/oss-security/2015/04/09/9
bugzilla.suse.com/show_bug.cgi?id=920926
github.com/advisories/GHSA-9w4f-3v37-6f75
github.com/ceph/ceph-deploy/commit/eee56770393bf19ed2dd5389226c6190c08dee3f
github.com/ceph/ceph-deploy/pull/272
nvd.nist.gov/vuln/detail/CVE-2015-3010
web.archive.org/web/20200228233028/www.securityfocus.com/bid/74043
Related
2.1 Low
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:L/Au:N/C:P/I:N/A:N
5.9 Medium
AI Score
Confidence
Low
0.0004 Low
EPSS
Percentile
5.1%