CVEvulnerability

CVE-2018-1129

6.5 MEDIUM Published 2018-07-10 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2018-07-10
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
6.5 MEDIUM — CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0 ([email protected])
3.3 LOW — AV:A/AC:L/Au:N/C:N/I:P/A:N
Weaknesses
CWE-284, CWE-287

Description

A flaw was found in the way signature calculation was handled by cephx authentication protocol. An attacker having access to ceph cluster network who is able to alter the message payload was able to bypass signature checks done by cephx protocol. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable.

Affected configurations

• redhat ceph storage 1.3 • redhat ceph storage 3 • redhat ceph storage mon 2 • redhat ceph storage mon 3 • redhat ceph storage osd 2 • redhat ceph storage osd 3 • redhat enterprise linux 7.0 • redhat enterprise linux desktop 7.0 • redhat enterprise linux server 7.0 • redhat enterprise linux workstation 7.0 • ceph ceph 10.2.0 • ceph ceph 10.2.1 • ceph ceph 10.2.2 • ceph ceph 10.2.3 • ceph ceph 10.2.4 • ceph ceph 10.2.5 • ceph ceph 10.2.6 • ceph ceph 10.2.7 • ceph ceph 10.2.8 • ceph ceph 10.2.9 • ceph ceph 10.2.10 • ceph ceph 10.2.11 • ceph ceph 12.2.0 • ceph ceph 12.2.1 • ceph ceph 12.2.2 • ceph ceph 12.2.3 • ceph ceph 12.2.4 • ceph ceph 12.2.5 • ceph ceph 12.2.6 • ceph ceph 12.2.7 • ceph ceph 13.2.0 • ceph ceph 13.2.1 • debian debian linux 8.0 • debian debian linux 9.0 • opensuse leap 15.0

Related

Weakness · CWE (2)

  • CWE-284 Improper Access Control weakness
  • CWE-287 Improper Authentication weakness

References