MediumFix available
ceph — security advisory
A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in clear text. This can be found by searching the mgr logs for grafana and dashboard, with passwords visible.
- Products
- ceph
- Affected versions
- Not specified
- Fixed versions
- 14.2.18-1
- CVEs
- CVE-2020-25678
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 13:43 UTC · Revision 1
Source evidence
A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in clear text. This can be found by searching the mgr logs for grafana and dashboard, with passwords visible.
osv:DEBIAN-CVE-2020-25678
ceph
Fixed versions: 14.2.18-1
ceph
Fixed versions: 14.2.18-1
ceph
Fixed versions: 14.2.18-1
Complete source record
{
"id": "e6982c7b6b2f1cb3c672be82ad11e799320f8c00e868b1a49e6a6137fa86a106",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2020-25678",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2020-25678",
"summary": "A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in clear text. This can be found by searching the mgr logs for grafana and dashboard, with passwords visible.",
"evidence": "osv:DEBIAN-CVE-2020-25678",
"products": [
{
"name": {
"value": "ceph",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "14.2.18-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "ceph",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "14.2.18-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "ceph",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "14.2.18-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "medium",
"structured": {
"id": "DEBIAN-CVE-2020-25678",
"aliases": [
"DEBIAN-CVE-2020-25678"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "14.2.18-1"
}
]
}
],
"package": {
"name": "ceph",
"purl": "pkg:deb/debian/ceph?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2020-25678.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "14.2.18-1"
}
]
}
],
"package": {
"name": "ceph",
"purl": "pkg:deb/debian/ceph?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2020-25678.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "14.2.18-1"
}
]
}
],
"package": {
"name": "ceph",
"purl": "pkg:deb/debian/ceph?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2020-25678.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-26T12:02:40.552788575Z",
"provider": "osv",
"upstream": [
"CVE-2020-25678"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2020-25678"
]
},
"related_cves": [
{
"value": "CVE-2020-25678",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 452726,
"published_at": "2021-01-08T18:15:13.293+00:00"
}