A flaw was found in the way signature calculation was handled by cephx authentication protocol. An attacker having access to ceph cluster network who is able to alter the message payload was able to bypass signature checks done by cephx protocol. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable.
References
| Link | Resource |
|---|---|
| https://github.com/ceph/ceph/commit/8f396cf35a3826044b089141667a196454c0a587 | Patch Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=1576057 | Issue Tracking Patch Third Party Advisory |
| http://tracker.ceph.com/issues/24837 | Issue Tracking Vendor Advisory |
| https://access.redhat.com/errata/RHSA-2018:2179 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2018:2177 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2018:2274 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2018:2261 | Third Party Advisory |
| https://www.debian.org/security/2018/dsa-4339 | Third Party Advisory |
| https://lists.debian.org/debian-lts-announce/2019/03/msg00017.html | Mailing List Third Party Advisory |
| http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00100.html | Third Party Advisory |
| http://packetstormsecurity.com/files/154245/Kernel-Live-Patch-Security-Notice-LSN-0054-1.html |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
History
No history.
Information
Published : 2018-07-10 14:29
Updated : 2019-08-29 03:15
NVD link : CVE-2018-1129
Mitre link : CVE-2018-1129
JSON object : View
Products Affected
debian
- debian_linux
redhat
- enterprise_linux
- ceph_storage
- enterprise_linux_desktop
- ceph_storage_mon
- enterprise_linux_server
- enterprise_linux_workstation
- ceph_storage_osd
opensuse
- leap
ceph
- ceph
CWE
CWE-287
Improper Authentication