It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to ceph cluster network who is able to sniff packets on network can use this vulnerability to authenticate with ceph service and perform actions allowed by ceph service. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade librgw2-develUpgrade librados-develUpgrade cephmetrics-grafana-pluginsUpgrade librbd-develUpgrade ceph-fuseUpgrade cephmetrics-collectorsUpgrade ceph-radosgwUpgrade python-rgwUpgrade nfs-ganesha-cephUpgrade ceph-baseUpgrade cephmetrics-ansibleUpgrade ceph-mdsUpgrade libcephfs-develUpgrade libcephfs1-develUpgrade ceph-ansibleUpgrade librgw2Upgrade libcephfs2Upgrade nfs-ganesha-rgwUpgrade ceph-debuginfoUpgrade nfs-ganeshaUpgrade python-cephfsUpgrade ceph-selinuxUpgrade ceph-commonUpgrade libradosstriper1Upgrade libcephfs1Upgrade cephmetricsUpgrade librgw-develUpgrade nfs-ganesha-debuginfoUpgrade rbd-mirror | Aug 28, 2019 | Jul 10, 2018 |
| Debian | — | Upgrade linuxUpgrade ceph | Nov 14, 2018 | Jul 10, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade python-perfUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-develUpgrade perfUpgrade kernel-headersUpgrade kernelUpgrade kernel-debuginfo | May 25, 2022 | Jul 10, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade kernel-toolsUpgrade kernel-tools-libsUpgrade kernelUpgrade python-perfUpgrade perfUpgrade kernel-headersUpgrade kernel-devel | Nov 19, 2019 | Jul 10, 2018 |
| Redhat_linux | — | Upgrade libradosstriper1Upgrade cephmetricsUpgrade ceph-radosgwUpgrade ceph-selinuxUpgrade ceph-mdsUpgrade librgw2Upgrade nfs-ganesha-rgwUpgrade python-rgwUpgrade libcephfs1-develUpgrade librbd-develUpgrade ceph-ansibleNo solution existsUpgrade cephmetrics-ansibleUpgrade libcephfs1Upgrade librgw2-develUpgrade ceph-debuginfoUpgrade librgw-develUpgrade libcephfs-develUpgrade libcephfs2Upgrade nfs-ganesha-debuginfoUpgrade rbd-mirrorUpgrade librados-develUpgrade nfs-ganesha-cephUpgrade cephmetrics-grafana-pluginsUpgrade cephmetrics-collectorsUpgrade nfs-ganeshaUpgrade python-cephfsUpgrade ceph-commonUpgrade ceph-baseUpgrade ceph-fuse | Jul 27, 2018 | Jul 10, 2018 |
| Suse | — | Upgrade kernel-source-azureUpgrade rbd-nbdUpgrade librados2Upgrade libcephfs2Upgrade libcephfs-develUpgrade libradospp-develUpgrade librados-develUpgrade kernel-obs-buildUpgrade kernel-docs-azureUpgrade librgw-develUpgrade kernel-defaultUpgrade python3-radosUpgrade ceph-commonUpgrade kernel-default-manUpgrade python3-ceph-argparseUpgrade rados-objclass-develUpgrade librbd-develUpgrade librgw2Upgrade kernel-default-extraUpgrade python3-cephfsUpgrade python3-ceph-commonUpgrade kernel-devel-azureUpgrade librbd1Upgrade python3-rgwUpgrade kernel-docsUpgrade kernel-azure-baseUpgrade python3-rbd | Aug 4, 2018 | Jul 10, 2018 |
| Ubuntu | — | No solution exists | Jan 29, 2021 | Jul 10, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 10, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub