HighFix available
ceph — security advisory
Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption key information in log files via plaintext. Versions up to v13.2.4 are vulnerable.
- Products
- ceph
- Affected versions
- Not specified
- Fixed versions
- 12.2.11+dfsg1-1
- CVEs
- CVE-2018-16889
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 00:36 UTC · Revision 1
Source evidence
Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption key information in log files via plaintext. Versions up to v13.2.4 are vulnerable.
osv:DEBIAN-CVE-2018-16889
ceph
Fixed versions: 12.2.11+dfsg1-1
ceph
Fixed versions: 12.2.11+dfsg1-1
ceph
Fixed versions: 12.2.11+dfsg1-1
Complete source record
{
"id": "51a71f3bbaaa3541535f526efe4a6defd8160ee23d0adeaa91b794875bcf4fe5",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2018-16889",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2018-16889",
"summary": "Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption key information in log files via plaintext. Versions up to v13.2.4 are vulnerable.",
"evidence": "osv:DEBIAN-CVE-2018-16889",
"products": [
{
"name": {
"value": "ceph",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "12.2.11+dfsg1-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "ceph",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "12.2.11+dfsg1-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "ceph",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "12.2.11+dfsg1-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "high",
"structured": {
"id": "DEBIAN-CVE-2018-16889",
"aliases": [
"DEBIAN-CVE-2018-16889"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "12.2.11+dfsg1-1"
}
]
}
],
"package": {
"name": "ceph",
"purl": "pkg:deb/debian/ceph?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2018-16889.json"
},
"ecosystem_specific": {
"urgency": "low"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "12.2.11+dfsg1-1"
}
]
}
],
"package": {
"name": "ceph",
"purl": "pkg:deb/debian/ceph?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2018-16889.json"
},
"ecosystem_specific": {
"urgency": "low"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "12.2.11+dfsg1-1"
}
]
}
],
"package": {
"name": "ceph",
"purl": "pkg:deb/debian/ceph?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2018-16889.json"
},
"ecosystem_specific": {
"urgency": "low"
}
}
],
"modified": "2026-10-23T18:03:28.802663870Z",
"provider": "osv",
"upstream": [
"CVE-2018-16889"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2018-16889"
]
},
"related_cves": [
{
"value": "CVE-2018-16889",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 421636,
"published_at": "2019-01-28T14:29:00.22+00:00"
}