A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph storage pools and corrupt snapshot images. Ceph branches master, mimic, luminous and jewel are believed to be affected.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade libcephfs-develUpgrade cephmetrics-ansibleUpgrade ceph-fuseUpgrade ceph-ansibleUpgrade ceph-radosgwUpgrade librbd-develUpgrade ceph-selinuxUpgrade libradosstriper1Upgrade librgw2Upgrade ceph-mdsUpgrade cephmetricsUpgrade cephmetrics-collectorsUpgrade python-rgwUpgrade ceph-commonUpgrade ceph-baseUpgrade ceph-debuginfoUpgrade librgw-develUpgrade nfs-ganesha-cephUpgrade libcephfs1-develUpgrade nfs-ganesha-debuginfoUpgrade rbd-mirrorUpgrade nfs-ganesha-rgwUpgrade python-cephfsUpgrade nfs-ganeshaUpgrade libcephfs1Upgrade librgw2-develUpgrade libcephfs2Upgrade librados-develUpgrade cephmetrics-grafana-plugins | Aug 28, 2019 | Jul 10, 2018 |
| Debian | — | Upgrade ceph | Nov 14, 2018 | Jul 10, 2018 |
| Redhat_linux | — | Upgrade libcephfs2Upgrade librgw2-develUpgrade rbd-mirrorUpgrade ceph-commonUpgrade librgw-develUpgrade cephmetricsUpgrade ceph-baseUpgrade ceph-fuseUpgrade cephmetrics-collectorsUpgrade python-cephfsUpgrade libcephfs1-develUpgrade libcephfs-develUpgrade nfs-ganesha-debuginfoUpgrade ceph-debuginfoUpgrade libcephfs1Upgrade librados-develUpgrade nfs-ganesha-rgwUpgrade cephmetrics-grafana-pluginsUpgrade ceph-selinuxUpgrade libradosstriper1Upgrade nfs-ganesha-cephUpgrade cephmetrics-ansibleUpgrade ceph-ansibleUpgrade ceph-radosgwUpgrade ceph-mdsUpgrade nfs-ganeshaUpgrade python-rgwUpgrade librgw2Upgrade librbd-devel | Jul 27, 2018 | Jul 10, 2018 |
| Suse | — | Upgrade librados2Upgrade ceph-testUpgrade ceph-fuseUpgrade libradospp-develUpgrade ceph-resource-agentsUpgrade rados-objclass-develUpgrade python-rgwUpgrade python3-rbdUpgrade python3-rgwUpgrade python3-cephfsUpgrade libradosstriper1Upgrade rbd-fuseUpgrade cephUpgrade ceph-mdsUpgrade ceph-osdUpgrade python3-ceph-argparseUpgrade librbd-develUpgrade python-radosUpgrade librgw2Upgrade ceph-radosgwUpgrade ceph-monUpgrade ceph-mgrUpgrade python-rbdUpgrade rbd-nbdUpgrade libcephfs2Upgrade librados-develUpgrade ceph-baseUpgrade rbd-mirrorUpgrade python3-ceph-commonUpgrade libcephfs-develUpgrade librgw-develUpgrade ceph-commonUpgrade python3-radosUpgrade python-cephfsUpgrade librbd1Upgrade libradosstriper-devel | Aug 4, 2018 | Jul 10, 2018 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Jul 10, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 10, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub