A flaw was found in the way signature calculation was handled by cephx authentication protocol. An attacker having access to ceph cluster network who is able to alter the message payload was able to bypass signature checks done by cephx protocol. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable.
References
| Link | Resource |
|---|---|
| https://github.com/ceph/ceph/commit/8f396cf35a3826044b089141667a196454c0a587 | Patch Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=1576057 | Issue Tracking Patch Third Party Advisory |
| http://tracker.ceph.com/issues/24837 | Issue Tracking Vendor Advisory |
| https://access.redhat.com/errata/RHSA-2018:2179 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2018:2177 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2018:2274 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2018:2261 | Third Party Advisory |
| https://www.debian.org/security/2018/dsa-4339 | Third Party Advisory |
| https://lists.debian.org/debian-lts-announce/2019/03/msg00017.html | Mailing List Third Party Advisory |
| http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00100.html | Third Party Advisory |
| http://packetstormsecurity.com/files/154245/Kernel-Live-Patch-Security-Notice-LSN-0054-1.html |
Advertisement
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
Information
Published : 2018-07-10 07:29
Updated : 2019-08-28 20:15
NVD link : CVE-2018-1129
Mitre link : CVE-2018-1129
JSON object : View
CWE
CWE-287
Improper Authentication
Advertisement
Products Affected
redhat
- enterprise_linux_desktop
- enterprise_linux
- enterprise_linux_workstation
- ceph_storage_osd
- ceph_storage_mon
- ceph_storage
- enterprise_linux_server
ceph
- ceph
opensuse
- leap
debian
- debian_linux