CVE-2018-16846

Published: Jan 15, 2019Modified: Nov 21, 2024

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

It was found in Ceph versions before 13.2.4 that authenticated ceph RGW users can cause a denial of service against OMAPs holding bucket indices.

Affected (10)

Products: Redhat: Ceph, Ceph Storage, Enterprise Linux Server · Debian: Debian Linux · Opensuse: Leap · +1 more

Show all products

Redhat: Ceph, Ceph Storage, Enterprise Linux Server · Debian: Debian Linux · Opensuse: Leap · Canonical: Ubuntu Linux

Redhat

3 products

Ceph

Ceph Storage

Enterprise Linux Server

1 product

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Redhat Ceph	Before 13.2.4

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0
Debian Debian Linux	Version 9.0

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Opensuse Leap	Version 15.0

Configuration D

3 vulnerable

Vulnerable Software	Affected Versions
Redhat Ceph Storage	Version 2.0
Redhat Ceph Storage	Version 3.0
Redhat Enterprise Linux Server	Version 7.0

Configuration E

3 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 16.04
Canonical Ubuntu Linux	Version 18.10
Canonical Ubuntu Linux	Version 19.04

Related CWEs

CWE-770

Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (16)

http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00100.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

https://access.redhat.com/errata/RHSA-2019:2538

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:2541

Source: secalert@redhat.com

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16846

Source: secalert@redhat.com

Issue TrackingPatchThird Party Advisory

https://ceph.com/releases/13-2-4-mimic-released/

Source: secalert@redhat.com

Vendor Advisory

https://lists.debian.org/debian-lts-announce/2019/03/msg00002.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2021/08/msg00013.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

https://usn.ubuntu.com/4035-1/

Source: secalert@redhat.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00100.html