Cleartext Storage of Sensitive Information Affecting librbd1-devel package, versions *
Threat Intelligence
EPSS
0.05% (19th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RHEL7-LIBRBD1DEVEL-4415594
- published 1 Nov 2021
- disclosed 23 Nov 2020
Introduced: 23 Nov 2020
CVE-2020-25678 Open this link in a new tabHow to fix?
There is no fixed version for RHEL:7 librbd1-devel.
NVD Description
Note: Versions mentioned in the description apply only to the upstream librbd1-devel package and not the librbd1-devel package as distributed by RHEL.
See How to fix? for RHEL:7 relevant fixed versions and status.
A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in clear text. This can be found by searching the mgr logs for grafana and dashboard, with passwords visible.
References
- https://access.redhat.com/security/cve/CVE-2020-25678
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OQTBKVXVYP7GPQNZ5VASOIJHMLK7727M/
- https://security.gentoo.org/glsa/202105-39
- https://bugzilla.redhat.com/show_bug.cgi?id=1892109
- https://tracker.ceph.com/issues/37503
- https://access.redhat.com/errata/RHSA-2021:1452
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OQTBKVXVYP7GPQNZ5VASOIJHMLK7727M/
- https://lists.debian.org/debian-lts-announce/2023/10/msg00034.html
CVSS Scores
version 3.1