GitHub Advisoryadvisory · PyPI

GHSA-9w4f-3v37-6f75 ceph-deploy allows local users to obtain sensitive information by reading the file

LOW Published 2022-05-17 Modified 2024-09-13 Official page ↗
Aliases
CVE-2015-3010
Ecosystem
PyPI
Packages
ceph-deploy
Severity
Low
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200
Reviewed
2024-04-29

Affected packages

• PyPI ceph-deploy: < 1.5.23 → fixed in 1.5.23

Description

ceph-deploy before 1.5.23 uses weak permissions (644) for `ceph/ceph.client.admin.keyring`, which allows local users to obtain sensitive information by reading the file.

Related

Alias · CVE (1)

  • CVE-2015-3010 ceph-deploy before 1.5.23 uses weak permissions (644) for ceph/ceph.client.admin.keyring, which allows local users to obtain sensitive… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References