It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to ceph cluster network who is able to sniff packets on network can use this vulnerability to authenticate with ceph service and perform actions allowed by ceph service. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade ceph-debuginfoUpgrade ceph-selinuxUpgrade ceph-ansibleUpgrade nfs-ganeshaUpgrade librgw-develUpgrade cephmetricsUpgrade libcephfs2Upgrade ceph-mdsUpgrade nfs-ganesha-rgwUpgrade librgw2Upgrade python-cephfsUpgrade libcephfs1Upgrade cephmetrics-ansibleUpgrade ceph-commonUpgrade libcephfs-develUpgrade libradosstriper1Upgrade rbd-mirrorUpgrade nfs-ganesha-debuginfoUpgrade libcephfs1-develUpgrade ceph-radosgwUpgrade cephmetrics-grafana-pluginsUpgrade librados-develUpgrade librgw2-develUpgrade ceph-baseUpgrade ceph-fuseUpgrade python-rgwUpgrade librbd-develUpgrade cephmetrics-collectorsUpgrade nfs-ganesha-ceph | Aug 28, 2019 | Jul 10, 2018 |
| Debian | — | Upgrade linuxUpgrade ceph | Nov 14, 2018 | Jul 10, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade kernel-debuginfo-common-x86_64Upgrade kernel-toolsUpgrade kernel-tools-libsUpgrade python-perfUpgrade kernel-develUpgrade kernel-headersUpgrade kernelUpgrade perfUpgrade kernel-debuginfo | May 25, 2022 | Jul 10, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade kernelUpgrade kernel-toolsUpgrade python-perfUpgrade kernel-tools-libsUpgrade perfUpgrade kernel-headersUpgrade kernel-devel | Nov 19, 2019 | Jul 10, 2018 |
| Redhat_linux | — | Upgrade ceph-ansibleUpgrade libcephfs1-develUpgrade librbd-develUpgrade librgw2Upgrade nfs-ganesha-rgwUpgrade ceph-selinuxNo solution existsUpgrade cephmetrics-ansibleUpgrade python-rgwUpgrade cephmetricsUpgrade libradosstriper1Upgrade ceph-mdsUpgrade ceph-radosgwUpgrade ceph-baseUpgrade librgw-develUpgrade cephmetrics-collectorsUpgrade cephmetrics-grafana-pluginsUpgrade libcephfs1Upgrade libcephfs-develUpgrade nfs-ganesha-debuginfoUpgrade rbd-mirrorUpgrade python-cephfsUpgrade nfs-ganesha-cephUpgrade ceph-commonUpgrade librados-develUpgrade libcephfs2Upgrade ceph-debuginfoUpgrade librgw2-develUpgrade ceph-fuseUpgrade nfs-ganesha | Jul 27, 2018 | Jul 10, 2018 |
| Suse | — | Upgrade librgw2Upgrade librbd-develUpgrade python3-cephfsUpgrade ceph-commonUpgrade kernel-default-extraUpgrade kernel-docsUpgrade python3-rgwUpgrade rados-objclass-develUpgrade librbd1Upgrade kernel-default-manUpgrade python3-ceph-argparseUpgrade kernel-devel-azureUpgrade python3-ceph-commonUpgrade python3-radosUpgrade kernel-azure-baseUpgrade python3-rbdUpgrade kernel-obs-buildUpgrade libcephfs2Upgrade kernel-source-azureUpgrade rbd-nbdUpgrade libradospp-develUpgrade librgw-develUpgrade kernel-docs-azureUpgrade kernel-defaultUpgrade librados2Upgrade librados-develUpgrade libcephfs-devel | Aug 4, 2018 | Jul 10, 2018 |
| Ubuntu | — | No solution exists | Jan 29, 2021 | Jul 10, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 10, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub