A flaw was found in the way signature calculation was handled by cephx authentication protocol. An attacker having access to ceph cluster network who is able to alter the message payload was able to bypass signature checks done by cephx protocol. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade ceph-commonUpgrade libcephfs-develUpgrade ceph-baseUpgrade libcephfs2Upgrade rbd-mirrorUpgrade libcephfs1Upgrade ceph-debuginfoUpgrade librgw2-develUpgrade libcephfs1-develUpgrade python-cephfsUpgrade librados-develUpgrade nfs-ganesha-debuginfoUpgrade librgw-develUpgrade librbd-develUpgrade cephmetrics-grafana-pluginsUpgrade ceph-selinuxUpgrade nfs-ganeshaUpgrade libradosstriper1Upgrade nfs-ganesha-rgwUpgrade ceph-fuseUpgrade nfs-ganesha-cephUpgrade ceph-ansibleUpgrade ceph-mdsUpgrade librgw2Upgrade cephmetricsUpgrade cephmetrics-collectorsUpgrade python-rgwUpgrade cephmetrics-ansibleUpgrade ceph-radosgw | Aug 28, 2019 | Jul 10, 2018 |
| Debian | — | Upgrade cephUpgrade linux | Nov 14, 2018 | Jul 10, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade perfUpgrade kernel-headersUpgrade kernel-toolsUpgrade kernelUpgrade kernel-develUpgrade kernel-tools-libsUpgrade python-perf | Dec 27, 2019 | Jul 10, 2018 |
| Redhat_linux | — | Upgrade ceph-baseUpgrade python-rgwUpgrade ceph-debuginfoUpgrade rbd-mirrorUpgrade ceph-mdsUpgrade ceph-selinuxUpgrade cephmetrics-ansibleUpgrade nfs-ganesha-debuginfoUpgrade python-cephfsUpgrade libradosstriper1Upgrade ceph-ansibleUpgrade cephmetrics-grafana-pluginsUpgrade nfs-ganeshaUpgrade ceph-fuseUpgrade libcephfs1-develUpgrade libcephfs-develNo solution existsUpgrade ceph-commonUpgrade libcephfs2Upgrade ceph-radosgwUpgrade librados-develUpgrade nfs-ganesha-rgwUpgrade librgw-develUpgrade nfs-ganesha-cephUpgrade cephmetricsUpgrade librbd-develUpgrade librgw2Upgrade librgw2-develUpgrade cephmetrics-collectorsUpgrade libcephfs1 | Jul 27, 2018 | Jul 10, 2018 |
| Suse | — | Upgrade libcephfs-develUpgrade python3-rgwUpgrade rados-objclass-develUpgrade kernel-docsUpgrade kernel-default-extraUpgrade python3-radosUpgrade kernel-devel-azureUpgrade kernel-defaultUpgrade librbd1Upgrade ceph-commonUpgrade librbd-develUpgrade python3-ceph-argparseUpgrade kernel-default-manUpgrade librados2Upgrade python3-cephfsUpgrade python3-ceph-commonUpgrade librgw2Upgrade kernel-azure-baseUpgrade librados-develUpgrade kernel-docs-azureUpgrade kernel-source-azureUpgrade libcephfs2Upgrade python3-rbdUpgrade rbd-nbdUpgrade librgw-develUpgrade kernel-obs-buildUpgrade libradospp-devel | Aug 4, 2018 | Jul 10, 2018 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Jul 10, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub