Skip to content
OpenAdvisories
Medium RHSA-2015:1092 2 CVEs

Red Hat Security Advisory: ceph-deploy security update

Published Sep 13, 2024 · Updated Nov 22, 2025

Ecosystem: Red Hat

Fixed packages 2

ReleasePackageFixed in
Red Hat · Ceph Storage 1 ceph_storage:1.2::el6 ceph-deploy 0:1.5.22-0.4.rc1.el6cp
Red Hat · Ceph Storage 1 ceph_storage:1.2::el7 ceph-deploy 0:1.5.22-0.4.rc1.el7cp

Vulnerabilities 2

  • Medium 4.0
    CVE-2015-3010

    ceph-deploy allows local users to obtain sensitive information by reading the file

    ceph-deploy before 1.5.23 uses weak permissions (644) for ceph/ceph.client.admin.keyring, which allows local users to obtain sensitive information by reading the file.

    ceph-deploy PyPI
  • Low —
    CVE-2015-4053

    ceph-deploy uses world-readable permissions on client.admin key

    The admin command in ceph-deploy before 1.5.25 uses world-readable permissions for /etc/ceph/ceph.client.admin.keyring, which allows local users to obtain sensitive information by reading the file.

    ceph-deploy PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1210705
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1224129
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1092.json
  • report
    https://access.redhat.com/security/cve/CVE-2015-3010
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2015-3010
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2015-3010
  • report
    https://access.redhat.com/security/cve/CVE-2015-4053
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2015-4053
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2015-4053