Vulnerability CVE-2018-10861
Published: 2018-07-10

Description:
A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph storage pools and corrupt snapshot images. Ceph branches master, mimic, luminous and jewel are believed to be affected.

Type:

CWE-287

 (Improper Authentication)

CVSS2 => (AV:N/AC:L/Au:S/C:N/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
5.5/10
4.9/10
8/10
Exploit range
Attack complexity
Authentication
Remote
Low
Single time
Confidentiality impact
Integrity impact
Availability impact
None
Partial
Partial
Affected software
Redhat -> Ceph storage 
Redhat -> Ceph storage mon 
Redhat -> Ceph storage osd 
Redhat -> Enterprise linux 
Redhat -> Enterprise linux desktop 
Redhat -> Enterprise linux server 
Redhat -> Enterprise linux workstation 
Opensuse -> LEAP 
Debian -> Debian linux 
CEPH -> CEPH 

 References:
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00100.html
http://tracker.ceph.com/issues/24838
http://www.securityfocus.com/bid/104742
https://access.redhat.com/errata/RHSA-2018:2177
https://access.redhat.com/errata/RHSA-2018:2179
https://access.redhat.com/errata/RHSA-2018:2261
https://access.redhat.com/errata/RHSA-2018:2274
https://bugzilla.redhat.com/show_bug.cgi?id=1593308
https://github.com/ceph/ceph/commit/975528f632f73fbffa3f1fee304e3bbe3296cffc
https://www.debian.org/security/2018/dsa-4339
Copyright 2024, cxsecurity.com

 

Back to Top