{
  "threat_severity" : "Moderate",
  "public_date" : "2020-11-23T00:00:00Z",
  "bugzilla" : {
    "description" : "ceph-ansible: insecure ownership on /etc/ceph/iscsi-gateway.conf configuration file",
    "id" : "1892108",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=1892108"
  },
  "cvss3" : {
    "cvss3_base_score" : "5.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
    "status" : "verified"
  },
  "cwe" : "CWE-312",
  "details" : [ "A flaw was found in Ceph-ansible v4.0.41 where it creates an /etc/ceph/iscsi-gateway.conf with insecure default permissions. This flaw allows any user on the system to read sensitive information within this file. The highest threat from this vulnerability is to confidentiality.", "A flaw was found in Ceph-ansible where it creates an /etc/ceph/iscsi-gateway.conf with insecure default permissions. This flaw allows any user on the system to read sensitive information within this file. The highest threat from this vulnerability is to confidentiality." ],
  "statement" : "Red Hat OpenStack Platform 13 ships the flawed code, however RHOSP does not deploy ceph-iscsi-gw role in any supported scenario.  For this reason, a ceph-ansible update will not be provided at this time.\nRed Hat Ceph Storage 3 and 4 create /etc/ceph/iscsi-gateway.conf with the insecure permissions.",
  "affected_release" : [ {
    "product_name" : "Red Hat Ceph Storage 4.2",
    "release_date" : "2021-01-12T00:00:00Z",
    "advisory" : "RHSA-2021:0081",
    "cpe" : "cpe:/a:redhat:ceph_storage:4::el7",
    "package" : "ceph-ansible-0:4.0.41-1.el7cp"
  }, {
    "product_name" : "Red Hat OpenShift Container Storage 4.6.0 on RHEL-8",
    "release_date" : "2021-02-01T00:00:00Z",
    "advisory" : "RHBA-2021:0305",
    "cpe" : "cpe:/a:redhat:openshift_container_storage:4.6::el8",
    "package" : "ocs4/cephcsi-rhel8:4.6-54.49cf5efdd.release_4.6"
  }, {
    "product_name" : "Red Hat OpenShift Container Storage 4.6.0 on RHEL-8",
    "release_date" : "2021-02-01T00:00:00Z",
    "advisory" : "RHBA-2021:0305",
    "cpe" : "cpe:/a:redhat:openshift_container_storage:4.6::el8",
    "package" : "ocs4/mcg-core-rhel8:5.6.0-42.6a01c5fc0.5.6"
  }, {
    "product_name" : "Red Hat OpenShift Container Storage 4.6.0 on RHEL-8",
    "release_date" : "2021-02-01T00:00:00Z",
    "advisory" : "RHBA-2021:0305",
    "cpe" : "cpe:/a:redhat:openshift_container_storage:4.6::el8",
    "package" : "ocs4/mcg-rhel8-operator:5.6.0-41.2279a46.5.6"
  }, {
    "product_name" : "Red Hat OpenShift Container Storage 4.6.0 on RHEL-8",
    "release_date" : "2021-02-01T00:00:00Z",
    "advisory" : "RHBA-2021:0305",
    "cpe" : "cpe:/a:redhat:openshift_container_storage:4.6::el8",
    "package" : "ocs4/ocs-must-gather-rhel8:4.6-78.3b7455e4.release_4.6"
  }, {
    "product_name" : "Red Hat OpenShift Container Storage 4.6.0 on RHEL-8",
    "release_date" : "2021-02-01T00:00:00Z",
    "advisory" : "RHBA-2021:0305",
    "cpe" : "cpe:/a:redhat:openshift_container_storage:4.6::el8",
    "package" : "ocs4/ocs-operator-bundle:4.6.2-1"
  }, {
    "product_name" : "Red Hat OpenShift Container Storage 4.6.0 on RHEL-8",
    "release_date" : "2021-02-01T00:00:00Z",
    "advisory" : "RHBA-2021:0305",
    "cpe" : "cpe:/a:redhat:openshift_container_storage:4.6::el8",
    "package" : "ocs4/ocs-rhel8-operator:4.6-78.3b7455e4.release_4.6"
  }, {
    "product_name" : "Red Hat OpenShift Container Storage 4.6.0 on RHEL-8",
    "release_date" : "2021-02-01T00:00:00Z",
    "advisory" : "RHBA-2021:0305",
    "cpe" : "cpe:/a:redhat:openshift_container_storage:4.6::el8",
    "package" : "ocs4/rook-ceph-rhel8-operator:4.6-82.8c7ed584.release_4.6"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Ceph Storage 2",
    "fix_state" : "Out of support scope",
    "package_name" : "ceph-ansible",
    "cpe" : "cpe:/a:redhat:ceph_storage:2"
  }, {
    "product_name" : "Red Hat Ceph Storage 3",
    "fix_state" : "Out of support scope",
    "package_name" : "ceph-ansible",
    "cpe" : "cpe:/a:redhat:ceph_storage:3"
  }, {
    "product_name" : "Red Hat OpenStack Platform 13 (Queens)",
    "fix_state" : "Will not fix",
    "package_name" : "ceph-ansible",
    "cpe" : "cpe:/a:redhat:openstack:13"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2020-25677\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-25677" ],
  "name" : "CVE-2020-25677",
  "csaw" : false
}