GHSA-h22j-342g-797c

GHSA-h22j-342g-797c PUBLISHED CVSS 4.400000095367432 MEDIUM

Record from GitHub Advisory Database · Published May 24, 2022

A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in clear text. This can be found by searching the mgr logs for grafana and dashboard, with passwords visible.

Risk scores

CVSS 3.1

4.400000095367432

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Timeline

May 24, 2022 CVE Published
Apr 29, 2026 Distribution Patch
Apr 30, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-h22j-342g-797c
vulnetix vdb fixes GHSA-h22j-342g-797c

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-h22j-342g-797c/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

https://nvd.nist.gov/vuln/detail/CVE-2020-25678 advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1892109 url
https://lists.debian.org/debian-lts-announce/2023/10/msg00034.html url
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OQTBKVXVYP7GPQNZ5VASOIJHMLK7727M url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OQTBKVXVYP7GPQNZ5VASOIJHMLK7727M url
https://access.redhat.com/errata/RHSA-2021:1452 url
https://access.redhat.com/security/cve/CVE-2020-25678 url
https://security.gentoo.org/glsa/202105-39 url
https://tracker.ceph.com/issues/37503 url

Look up in the Resolve Platform →