A flaw was found in the way signature calculation was handled by cephx authentication protocol. An attacker having access to ceph cluster network who is able to alter the message payload was able to bypass signature checks done by cephx protocol. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade librados-develUpgrade ceph-baseUpgrade libcephfs1Upgrade nfs-ganesha-debuginfoUpgrade libcephfs1-develUpgrade ceph-commonUpgrade libcephfs-develUpgrade rbd-mirrorUpgrade python-cephfsUpgrade librgw-develUpgrade libcephfs2Upgrade ceph-debuginfoUpgrade librgw2-develUpgrade ceph-selinuxUpgrade librbd-develUpgrade nfs-ganesha-cephUpgrade cephmetricsUpgrade librgw2Upgrade cephmetrics-grafana-pluginsUpgrade cephmetrics-ansibleUpgrade ceph-fuseUpgrade nfs-ganesha-rgwUpgrade ceph-radosgwUpgrade nfs-ganeshaUpgrade libradosstriper1Upgrade cephmetrics-collectorsUpgrade ceph-mdsUpgrade ceph-ansibleUpgrade python-rgw | Aug 28, 2019 | Jul 10, 2018 |
| Debian | — | Upgrade linuxUpgrade ceph | Nov 14, 2018 | Jul 10, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade kernel-headersUpgrade perfUpgrade kernel-toolsUpgrade kernelUpgrade kernel-develUpgrade python-perfUpgrade kernel-tools-libs | Dec 27, 2019 | Jul 10, 2018 |
| Redhat_linux | — | Upgrade librados-develUpgrade librgw-develUpgrade librgw2-develUpgrade nfs-ganesha-rgwUpgrade cephmetricsUpgrade nfs-ganesha-cephUpgrade librbd-develUpgrade ceph-radosgwUpgrade libcephfs2Upgrade cephmetrics-collectorsUpgrade libcephfs1Upgrade librgw2Upgrade nfs-ganeshaUpgrade cephmetrics-ansibleUpgrade ceph-ansibleUpgrade ceph-selinuxUpgrade libradosstriper1No solution existsUpgrade ceph-baseUpgrade ceph-fuseUpgrade ceph-debuginfoUpgrade libcephfs1-develUpgrade nfs-ganesha-debuginfoUpgrade python-cephfsUpgrade ceph-mdsUpgrade cephmetrics-grafana-pluginsUpgrade python-rgwUpgrade libcephfs-develUpgrade ceph-commonUpgrade rbd-mirror | Jul 27, 2018 | Jul 10, 2018 |
| Suse | — | Upgrade python3-cephfsUpgrade ceph-commonUpgrade rados-objclass-develUpgrade python3-rgwUpgrade kernel-default-extraUpgrade libcephfs-develUpgrade librgw2Upgrade kernel-default-manUpgrade librados2Upgrade kernel-defaultUpgrade python3-ceph-commonUpgrade librbd-develUpgrade kernel-devel-azureUpgrade python3-ceph-argparseUpgrade librbd1Upgrade python3-radosUpgrade kernel-docsUpgrade rbd-nbdUpgrade libcephfs2Upgrade kernel-azure-baseUpgrade librados-develUpgrade python3-rbdUpgrade kernel-docs-azureUpgrade kernel-obs-buildUpgrade librgw-develUpgrade libradospp-develUpgrade kernel-source-azure | Aug 4, 2018 | Jul 10, 2018 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Jul 10, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub