CVE-2020-25678

Name	CVE-2020-25678
Description	A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in clear text. This can be found by searching the mgr logs for grafana and dashboard, with passwords visible.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
ceph (PTS)	stretch	10.2.11-2	vulnerable
	stretch (security)	10.2.11-2+deb9u1	vulnerable
	buster	12.2.11+dfsg1-2.1	vulnerable
	bullseye	14.2.21-1	fixed
	bookworm, sid	16.2.7+ds-4	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
ceph	source	(unstable)	14.2.18-1

Notes

[buster] - ceph <no-dsa> (Minor issue)
[stretch] - ceph <no-dsa> (Minor issue)
https://tracker.ceph.com/issues/37503
https://github.com/ceph/ceph/pull/38614 (v14.2.17)