What is CVE-2018-1129?

CVE-2018-1129 is a medium-severity vulnerability in Ceph, classified under Improper Access Control. CVSS score: 6.5/10. Published 2018-07-10.

How severe is CVE-2018-1129?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Auth bypass in Ceph

CVE-2018-1129

A flaw was found in the way signature calculation was handled by cephx authentication protocol. An attacker having access to ceph cluster network who is able to alter the message payload was able to bypass signature checks done by cephx pr…

EPSS: 0.019 (77.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.

Affected products

Ceph — versions 10.2.0, 10.2.1, 10.2.2
Red Hat, Inc. Ceph — versions all versions in branches master, mimic, luminous and jewel
Debian Debian_linux — versions 8.0, 9.0
Opensuse Leap — versions 15.0
Redhat Ceph_storage — versions 1.3, 3
Redhat Ceph_storage_mon — versions 2, 3
Redhat Ceph_storage_osd — versions 2, 3
Redhat Enterprise_linux — versions 7.0
Redhat Enterprise_linux_desktop — versions 7.0
Redhat Enterprise_linux_server — versions 7.0

Weakness classification (CWE)

References

secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
secalert@redhat.com (x_refsource_CONFIRM, Patch, Third Party Advisory, Issue Tracking)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
secalert@redhat.com (x_refsource_CONFIRM, Issue Tracking, Vendor Advisory)
secalert@redhat.com (x_refsource_CONFIRM, Patch, Third Party Advisory)
secalert@redhat.com (vendor-advisory, Third Party Advisory, x_refsource_DEBIAN)
secalert@redhat.com (mailing-list, x_refsource_MLIST, Mailing List, Third Party Advisory)
secalert@redhat.com (vendor-advisory, Third Party Advisory, x_refsource_SUSE)

Frequently asked questions

What is CVE-2018-1129?: CVE-2018-1129 is a medium-severity vulnerability in Ceph, classified under Improper Access Control. CVSS score: 6.5/10. Published 2018-07-10.
How severe is CVE-2018-1129?: Medium severity. CVSS v3 base score is 6.5 out of 10.