VULNERABILITY INTELLIGENCE

CVE-2018-16889

CVSS score5.5 MEDIUM
EPSS probability0.54%
CISA KEVNot currently listed
Published2019-01-28
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Description

Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption key information in log files via plaintext. Versions up to v13.2.4 are vulnerable.

Weakness classification

  • CWE-20: Improper Input Validation
  • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-312: Cleartext Storage of Sensitive Information
  • CWE-532: Insertion of Sensitive Information into Log File

Primary references