It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to ceph cluster network who is able to sniff packets on network can use this vulnerability to authenticate with ceph service and perform actions allowed by ceph service. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade libcephfs-develUpgrade rbd-mirrorUpgrade python-cephfsUpgrade nfs-ganeshaUpgrade ceph-commonUpgrade libradosstriper1Upgrade ceph-selinuxUpgrade cephmetricsUpgrade cephmetrics-ansibleUpgrade nfs-ganesha-debuginfoUpgrade libcephfs1Upgrade ceph-ansibleUpgrade libcephfs2Upgrade libcephfs1-develUpgrade librgw-develUpgrade nfs-ganesha-rgwUpgrade librgw2Upgrade ceph-mdsUpgrade ceph-debuginfoUpgrade nfs-ganesha-cephUpgrade python-rgwUpgrade cephmetrics-grafana-pluginsUpgrade ceph-fuseUpgrade librbd-develUpgrade ceph-baseUpgrade ceph-radosgwUpgrade librgw2-develUpgrade librados-develUpgrade cephmetrics-collectors | Aug 28, 2019 | Jul 10, 2018 |
| Debian | — | Upgrade linuxUpgrade ceph | Nov 14, 2018 | Jul 10, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade kernel-headersUpgrade kernel-debuginfoUpgrade kernel-develUpgrade perfUpgrade kernelUpgrade python-perfUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-toolsUpgrade kernel-tools-libs | May 25, 2022 | Jul 10, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade kernel-headersUpgrade kernel-develUpgrade perfUpgrade kernel-toolsUpgrade kernelUpgrade kernel-tools-libsUpgrade python-perf | Nov 19, 2019 | Jul 10, 2018 |
| Redhat_linux | — | Upgrade libcephfs1-develUpgrade librgw2Upgrade ceph-mdsUpgrade librbd-develNo solution existsUpgrade nfs-ganesha-rgwUpgrade ceph-radosgwUpgrade cephmetricsUpgrade python-rgwUpgrade ceph-ansibleUpgrade cephmetrics-ansibleUpgrade ceph-selinuxUpgrade libradosstriper1Upgrade nfs-ganesha-debuginfoUpgrade ceph-debuginfoUpgrade cephmetrics-grafana-pluginsUpgrade librados-develUpgrade nfs-ganesha-cephUpgrade nfs-ganeshaUpgrade ceph-baseUpgrade libcephfs2Upgrade rbd-mirrorUpgrade libcephfs1Upgrade ceph-commonUpgrade python-cephfsUpgrade cephmetrics-collectorsUpgrade libcephfs-develUpgrade librgw2-develUpgrade ceph-fuseUpgrade librgw-devel | Jul 27, 2018 | Jul 10, 2018 |
| Suse | — | Upgrade librbd1Upgrade kernel-default-extraUpgrade python3-rbdUpgrade kernel-azure-baseUpgrade librbd-develUpgrade python3-rgwUpgrade ceph-commonUpgrade kernel-docsUpgrade python3-ceph-commonUpgrade python3-cephfsUpgrade rados-objclass-develUpgrade python3-ceph-argparseUpgrade librgw2Upgrade python3-radosUpgrade kernel-devel-azureUpgrade kernel-default-manUpgrade rbd-nbdUpgrade libradospp-develUpgrade librgw-develUpgrade libcephfs2Upgrade kernel-docs-azureUpgrade kernel-source-azureUpgrade kernel-defaultUpgrade librados2Upgrade kernel-obs-buildUpgrade librados-develUpgrade libcephfs-devel | Aug 4, 2018 | Jul 10, 2018 |
| Ubuntu | — | No solution exists | Jan 29, 2021 | Jul 10, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 10, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub