← Back

CVE-2018-1129

nvd nist
Published: Jul 10, 2018Modified: Nov 21, 2024

JSON object

Loading...
6.5
Vector
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Exploitability: 2.8 / Impact: 3.6
Source: NVD

Description

A flaw was found in the way signature calculation was handled by cephx authentication protocol. An attacker having access to ceph cluster network who is able to alter the message payload was able to bypass signature checks done by cephx protocol. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable.

Affected (35)

Show all products
Redhat: Ceph Storage, Ceph Storage Mon, Ceph Storage Osd, Enterprise Linux, Enterprise Linux Desktop, Enterprise Linux Server, Enterprise Linux Workstation · Ceph: Ceph · Debian: Debian Linux · Opensuse: Leap
Redhat
7 products
Ceph Storage
Ceph Storage Mon
Ceph Storage Osd
Enterprise Linux
Enterprise Linux Desktop
Enterprise Linux Server
Enterprise Linux Workstation
Ceph
1 product
Ceph
Debian
1 product
Debian Linux
Opensuse
1 product
Leap
Configuration A
10 vulnerable
Vulnerable SoftwareAffected Versions
Redhat
Ceph Storage
Version 1.3
Ceph Storage
Version 3
Redhat
Ceph Storage Mon
Version 2
Ceph Storage Mon
Version 3
Redhat
Ceph Storage Osd
Version 2
Ceph Storage Osd
Version 3
Enterprise Linux
Version 7.0
Enterprise Linux Desktop
Version 7.0
Enterprise Linux Server
Version 7.0
Enterprise Linux Workstation
Version 7.0
Configuration B
22 vulnerable
Vulnerable SoftwareAffected Versions
Ceph
Ceph
Version 10.2.0
Ceph
Version 10.2.10
Ceph
Version 10.2.11
Ceph
Version 10.2.1
Ceph
Version 10.2.2
Ceph
Version 10.2.3
Ceph
Version 10.2.4
Ceph
Version 10.2.5
Ceph
Version 10.2.6
Ceph
Version 10.2.7
Ceph
Version 10.2.8
Ceph
Version 10.2.9
Ceph
Version 12.2.0
Ceph
Version 12.2.1
Ceph
Version 12.2.2
Ceph
Version 12.2.3
Ceph
Version 12.2.4
Ceph
Version 12.2.5
Ceph
Version 12.2.6
Ceph
Version 12.2.7
Ceph
Version 13.2.0
Ceph
Version 13.2.1
Configuration C
2 vulnerable
Vulnerable SoftwareAffected Versions
Debian
Debian Linux
Version 8.0
Debian Linux
Version 9.0
Configuration D
1 vulnerable
Vulnerable SoftwareAffected Versions
Leap
Version 15.0

Related CWEs

CWE-284
Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-287
Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (22)

Source: secalert@redhat.com
Third Party Advisory
Source: secalert@redhat.com
Source: secalert@redhat.com
Issue TrackingVendor Advisory
Source: secalert@redhat.com
Third Party Advisory
Source: secalert@redhat.com
Third Party Advisory
Source: secalert@redhat.com
Third Party Advisory
Source: secalert@redhat.com
Third Party Advisory
Source: secalert@redhat.com
Issue TrackingPatchThird Party Advisory
Source: secalert@redhat.com
PatchThird Party Advisory
Source: secalert@redhat.com
Mailing ListThird Party Advisory
Source: secalert@redhat.com
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingPatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory

Timeline

No history available yet.