CVE-2024-47866 | High | 7.5 | 2025-11-12 | Ceph is a distributed object, block, and file storage platform. In versions up to and including 19.2.3, using the argument `x-amz-copy-source` to put an object… |
CVE-2024-48916 | High | 8.1 | 2025-07-30 | Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has "none" as JWT alg. And by… |
CVE-2025-52555 | Medium | 6.5 | 2025-06-26 | Ceph is a distributed object, block, and file storage platform. In versions 17.2.7, 18.2.1 through 18.2.4, and 19.0.0 through 19.2.2, an unprivileged user can… |
CVE-2020-1716 | High | 8.8 | 2021-05-28 | A flaw was found in the ceph-ansible playbook where it contained hardcoded passwords that were being used as default passwords while deploying Ceph services. A… |
CVE-2020-25677 | Medium | 5.5 | 2020-12-08 | A flaw was found in Ceph-ansible v4.0.41 where it creates an /etc/ceph/iscsi-gateway.conf with insecure default permissions. This flaw allows any user on the s… |
CVE-2020-1700 | Medium | 6.5 | 2020-02-07 | A flaw was found in the way the Ceph RGW Beast front-end handles unexpected disconnects. An authenticated attacker can abuse this flaw by making multiple disco… |
CVE-2019-10222 | High | 7.5 | 2019-11-08 | A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests. An unauthenticated attacker could crash the Ceph RGW serve… |
CVE-2019-3821 | High | 7.5 | 2019-03-27 | A flaw was found in the way civetweb frontend was handling requests for ceph RGW server with SSL enabled. An unauthenticated attacker could create multiple con… |
CVE-2017-7519 | Low | 2.3 | 2018-07-27 | In Ceph, a format string flaw was found in the way libradosstriper parses input from user. A user could crash an application or service using the libradosstrip… |
CVE-2018-1129 | Medium | 6.5 | 2018-07-10 | A flaw was found in the way signature calculation was handled by cephx authentication protocol. An attacker having access to ceph cluster network who is able t… |
CVE-2018-10861 | High | 8.1 | 2018-07-10 | A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph storage pools and co… |
CVE-2017-12155 | Medium | 6.3 | 2017-12-12 | A resource-permission flaw was found in the openstack-tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable. A local… |
CVE-2015-3010 | | | 2015-06-16 | ceph-deploy before 1.5.23 uses weak permissions (644) for ceph/ceph.client.admin.keyring, which allows local users to obtain sensitive information by reading t… |
CVE-2015-4053 | | | 2015-06-08 | The admin command in ceph-deploy before 1.5.25 uses world-readable permissions for /etc/ceph/ceph.client.admin.keyring, which allows local users to obtain sens… |