A flaw was found in the way signature calculation was handled by cephx authentication protocol. An attacker having access to ceph cluster network who is able to alter the message payload was able to bypass signature checks done by cephx protocol. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade librgw2-develUpgrade ceph-baseUpgrade librgw-develUpgrade libcephfs2Upgrade libcephfs-develUpgrade libcephfs1-develUpgrade librados-develUpgrade libcephfs1Upgrade ceph-commonUpgrade ceph-debuginfoUpgrade nfs-ganesha-debuginfoUpgrade rbd-mirrorUpgrade python-cephfsUpgrade nfs-ganeshaUpgrade cephmetrics-collectorsUpgrade ceph-mdsUpgrade nfs-ganesha-cephUpgrade librgw2Upgrade cephmetricsUpgrade nfs-ganesha-rgwUpgrade cephmetrics-grafana-pluginsUpgrade python-rgwUpgrade ceph-radosgwUpgrade libradosstriper1Upgrade ceph-fuseUpgrade librbd-develUpgrade ceph-selinuxUpgrade cephmetrics-ansibleUpgrade ceph-ansible | Aug 28, 2019 | Jul 10, 2018 |
| Debian | — | Upgrade linuxUpgrade ceph | Nov 14, 2018 | Jul 10, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade kernelUpgrade kernel-headersUpgrade perfUpgrade kernel-toolsUpgrade python-perfUpgrade kernel-develUpgrade kernel-tools-libs | Dec 27, 2019 | Jul 10, 2018 |
| Redhat_linux | — | Upgrade ceph-selinuxUpgrade python-cephfsUpgrade libradosstriper1Upgrade cephmetrics-ansibleUpgrade ceph-debuginfoUpgrade nfs-ganeshaUpgrade ceph-commonUpgrade python-rgwUpgrade nfs-ganesha-debuginfoUpgrade ceph-baseUpgrade libcephfs-develUpgrade ceph-mdsUpgrade ceph-fuseNo solution existsUpgrade rbd-mirrorUpgrade ceph-ansibleUpgrade cephmetrics-grafana-pluginsUpgrade libcephfs1-develUpgrade librgw2Upgrade nfs-ganesha-cephUpgrade cephmetricsUpgrade librbd-develUpgrade librgw-develUpgrade librados-develUpgrade libcephfs2Upgrade ceph-radosgwUpgrade nfs-ganesha-rgwUpgrade cephmetrics-collectorsUpgrade librgw2-develUpgrade libcephfs1 | Jul 27, 2018 | Jul 10, 2018 |
| Suse | — | Upgrade kernel-default-extraUpgrade librbd-develUpgrade kernel-default-manUpgrade python3-radosUpgrade rados-objclass-develUpgrade python3-rgwUpgrade librados2Upgrade kernel-docsUpgrade python3-ceph-argparseUpgrade kernel-devel-azureUpgrade libcephfs-develUpgrade python3-ceph-commonUpgrade librbd1Upgrade librgw2Upgrade python3-cephfsUpgrade kernel-defaultUpgrade ceph-commonUpgrade rbd-nbdUpgrade librgw-develUpgrade kernel-source-azureUpgrade libradospp-develUpgrade python3-rbdUpgrade kernel-docs-azureUpgrade librados-develUpgrade kernel-obs-buildUpgrade kernel-azure-baseUpgrade libcephfs2 | Aug 4, 2018 | Jul 10, 2018 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Jul 10, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub