CVE-2018-1128

It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to ceph cluster network who is able to sniff packets on network can use this vulnerability to authenticate with ceph service and perform actions allowed by ceph service. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable.

Published : 2018-07-10 14:29 Updated : 2019-10-09 23:38

5.4
CVSS Score More info
Score 5.4 / 10
5.4
Vendor Product Version URI
Redhat Ceph Storage 3 cpe:/a:redhat:ceph_storage:3
Redhat Ceph Storage Mon 2 cpe:/a:redhat:ceph_storage_mon:2
Redhat Ceph Storage Mon 3 cpe:/a:redhat:ceph_storage_mon:3
Redhat Ceph Storage Osd 2 cpe:/a:redhat:ceph_storage_osd:2
Redhat Ceph Storage Osd 3 cpe:/a:redhat:ceph_storage_osd:3
Redhat Enterprise Linux Desktop 7.0 cpe:/o:redhat:enterprise_linux_desktop:7.0
Redhat Enterprise Linux Server 7.0 cpe:/o:redhat:enterprise_linux_server:7.0
Redhat Enterprise Linux Workstation 7.0 cpe:/o:redhat:enterprise_linux_workstation:7.0
Debian Debian Linux 8.0 cpe:/o:debian:debian_linux:8.0
Debian Debian Linux 9.0 cpe:/o:debian:debian_linux:9.0
Opensuse Leap 15.0 cpe:/o:opensuse:leap:15.0
Redhat Enterprise Linux 7.0 cpe:/o:redhat:enterprise_linux:7.0
Redhat Ceph 10.2.0 cpe:/a:redhat:ceph:10.2.0
Redhat Ceph 10.2.1 cpe:/a:redhat:ceph:10.2.1
Redhat Ceph 10.2.2 cpe:/a:redhat:ceph:10.2.2
Redhat Ceph 10.2.3 cpe:/a:redhat:ceph:10.2.3
Redhat Ceph 10.2.4 cpe:/a:redhat:ceph:10.2.4
Redhat Ceph 10.2.5 cpe:/a:redhat:ceph:10.2.5
Redhat Ceph 10.2.6 cpe:/a:redhat:ceph:10.2.6
Redhat Ceph 10.2.7 cpe:/a:redhat:ceph:10.2.7
Redhat Ceph 10.2.8 cpe:/a:redhat:ceph:10.2.8
Redhat Ceph 10.2.9 cpe:/a:redhat:ceph:10.2.9
Redhat Ceph 10.2.10 cpe:/a:redhat:ceph:10.2.10
Redhat Ceph 10.2.11 cpe:/a:redhat:ceph:10.2.11
Redhat Ceph 11.0.0 cpe:/a:redhat:ceph:11.0.0
Redhat Ceph 11.0.1 cpe:/a:redhat:ceph:11.0.1
Redhat Ceph 11.0.2 cpe:/a:redhat:ceph:11.0.2
Redhat Ceph 11.1.0 cpe:/a:redhat:ceph:11.1.0
Redhat Ceph 11.1.1 cpe:/a:redhat:ceph:11.1.1
Redhat Ceph 11.2.0 cpe:/a:redhat:ceph:11.2.0
Redhat Ceph 11.2.1 cpe:/a:redhat:ceph:11.2.1
Redhat Ceph 12.0.0 cpe:/a:redhat:ceph:12.0.0
Redhat Ceph 12.0.1 cpe:/a:redhat:ceph:12.0.1
Redhat Ceph 12.0.2 cpe:/a:redhat:ceph:12.0.2
Redhat Ceph 12.0.3 cpe:/a:redhat:ceph:12.0.3
Redhat Ceph 12.1.0 cpe:/a:redhat:ceph:12.1.0
Redhat Ceph 12.1.1 cpe:/a:redhat:ceph:12.1.1
Redhat Ceph 12.1.2 cpe:/a:redhat:ceph:12.1.2
Redhat Ceph 12.1.3 cpe:/a:redhat:ceph:12.1.3
Redhat Ceph 12.1.4 cpe:/a:redhat:ceph:12.1.4
Redhat Ceph 12.2.0 cpe:/a:redhat:ceph:12.2.0
Redhat Ceph 12.2.1 cpe:/a:redhat:ceph:12.2.1
Redhat Ceph 12.2.2 cpe:/a:redhat:ceph:12.2.2
Redhat Ceph 12.2.3 cpe:/a:redhat:ceph:12.2.3
Redhat Ceph 12.2.4 cpe:/a:redhat:ceph:12.2.4
Redhat Ceph 12.2.5 cpe:/a:redhat:ceph:12.2.5
Redhat Ceph 12.2.6 cpe:/a:redhat:ceph:12.2.6
Redhat Ceph 12.2.7 cpe:/a:redhat:ceph:12.2.7
Redhat Ceph 12.2.8 cpe:/a:redhat:ceph:12.2.8
Redhat Ceph 12.2.9 cpe:/a:redhat:ceph:12.2.9
Redhat Ceph 12.2.10 cpe:/a:redhat:ceph:12.2.10
Redhat Ceph 13.0.0 cpe:/a:redhat:ceph:13.0.0
Redhat Ceph 13.0.1 cpe:/a:redhat:ceph:13.0.1
Redhat Ceph 13.0.2 cpe:/a:redhat:ceph:13.0.2
Redhat Ceph 13.1.0 cpe:/a:redhat:ceph:13.1.0
Redhat Ceph 13.1.1 cpe:/a:redhat:ceph:13.1.1
Redhat Ceph 13.2.0 cpe:/a:redhat:ceph:13.2.0
Redhat Ceph 13.2.1 cpe:/a:redhat:ceph:13.2.1
  1. Redhat (8) Search CVE
    1. Ceph Storage (1) Search CVE
      1. 3
    2. Enterprise Linux Server (1) Search CVE
      1. 7.0
    3. Enterprise Linux Desktop (1) Search CVE
      1. 7.0
    4. Enterprise Linux Workstation (1) Search CVE
      1. 7.0
    5. Enterprise Linux (1) Search CVE
      1. 7.0
    6. Ceph Storage Osd (2) Search CVE
      1. 2
      2. 3
    7. Ceph (46) Search CVE
      1. 10.2.0
      2. 10.2.1
      3. 10.2.2
      4. 10.2.3
      5. 10.2.4
      6. 10.2.5
      7. 10.2.6
      8. 10.2.7
      9. 10.2.8
      10. 10.2.9
      11. 10.2.10
      12. 10.2.11
      13. 11.0.0
      14. 11.0.1
      15. 11.0.2
      16. 11.1.0
      17. 11.1.1
      18. 11.2.0
      19. 11.2.1
      20. 12.0.0
      21. 12.0.1
      22. 12.0.2
      23. 12.0.3
      24. 12.1.0
      25. 12.1.1
      26. 12.1.2
      27. 12.1.3
      28. 12.1.4
      29. 12.2.0
      30. 12.2.1
      31. 12.2.2
      32. 12.2.3
      33. 12.2.4
      34. 12.2.5
      35. 12.2.6
      36. 12.2.7
      37. 12.2.8
      38. 12.2.9
      39. 12.2.10
      40. 13.0.0
      41. 13.0.1
      42. 13.0.2
      43. 13.1.0
      44. 13.1.1
      45. 13.2.0
      46. 13.2.1
    8. Ceph Storage Mon (2) Search CVE
      1. 2
      2. 3
  2. Opensuse (1) Search CVE
    1. Leap (1) Search CVE
      1. 15.0
  3. Debian (1) Search CVE
    1. Debian Linux (2) Search CVE
      1. 8.0
      2. 9.0

CWE

ID Name Description Links
CWE-287 Improper Authentication When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct. CVE

History of changes

Date Event
2019-10-09 23:38
2019-05-21 18:46
2019-05-13 13:49
2019-04-28 00:29
2019-03-21 16:00
2018-11-14 11:29
2018-09-12 19:05
2018-07-28 01:29
2018-07-13 01:29
2018-07-10 14:29

New CVE