CE
Product
Ceph
17
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 7Medium 9Low 0
Watch
Add Ceph to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-25660 | 8.8 | Nov 23 | A flaw was found in the Cephx authentication protocol in versions before 15.2.6 and before 14.2.14, where it does not verify Ceph clients correctly and is then vulnerable to… Affected: before 14.2.14; 15.0.0 before 15.2.6 |
| CVE-2022-3650 | 7.8 | Jan 17 | A privilege escalation flaw was found in Ceph Affected: 16.2.9 |
| CVE-2024-47866 | 7.5 | Nov 12 | RGW DoS attack with empty HTTP header in S3 object copy Affected: through 19.2.3 |
| CVE-2018-16889 | 7.5 | Jan 28 | Ceph does not properly sanitize encryption keys in debug logging for v4 auth Affected: through 13.2.4 |
| CVE-2018-1128 | 7.5 | Jul 10 | It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack Affected: 10.2.0 through 13.2.1 |
| CVE-2018-7262 | 7.5 | Mar 19 | In Ceph before 12.2.3 and 13.x through 13.0.1, the rgw_civetweb.cc RGWCivetWeb::init_env function in radosgw doesn't handle malformed HTTP headers properly, allowing for denial of… Affected: before 12.2.3; 13.0.0; 13.0.1 |
| CVE-2020-27781 | 7.1 | Dec 18 | User credentials can be manipulated and stolen by Native CephFS consumers of OpenStack Manila, resulting in potential privilege escalation Affected: before 14.2.16; 15.0.0 before 15.2.8; 16.0.0 before 16.2.0 |
| CVE-2021-3524 | 6.5 | May 17 | A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in versions before 14.2.21 Affected: before 14.2.21 |
| CVE-2018-16846 | 6.5 | Jan 15 | It was found in Ceph versions before 13.2.4 that authenticated ceph RGW users can cause a denial of service against OMAPs holding bucket indices Affected: before 13.2.4 |
| CVE-2016-8626 | 6.5 | Jul 31 | A flaw was found in Red Hat Ceph before 0.94.9-8 Affected: before 0.94.3.9-8 |
| CVE-2017-16818 | 6.5 | Dec 20 | RADOS Gateway in Ceph 12.1.0 through 12.2.1 allows remote authenticated users to cause a denial of service (assertion failure and application exit) by leveraging "full" (not… Affected: 12.1.0 through 12.2.1 |
| CVE-2016-5009 | 6.5 | Jul 12 | The handle_command function in mon/Monitor.cc in Ceph allows remote authenticated users to cause a denial of service (segmentation fault and ceph monitor crash) via an (1) empty… Affected: through 0.94.6 |
| CVE-2018-14662 | 5.7 | Jan 15 | It was found Ceph versions before 13.2.4 that authenticated ceph users with read only permissions could steal dm-crypt encryption keys used in ceph disk encryption Affected: before 13.2.4 |
| CVE-2020-27839 | 5.4 | May 26 | A flaw was found in ceph-dashboard Affected: before 14.2.17; 15.2.0 before 15.2.9 |
| CVE-2021-3531 | 5.3 | May 18 | A flaw was found in the Red Hat Ceph Storage RGW in versions before 14.2.21 Affected: before 14.2.21 |
| CVE-2020-25678 | 4.4 | Jan 8 | A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in clear text Affected: before 16.2.0 |
| CVE-2015-5245 | – | Dec 3 | CRLF injection vulnerability in the Ceph Object Gateway (aka radosgw or RGW) in Ceph before 0.94.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP… Affected: through 0.94.3 |
Showing 17