CVE-2018-1128
- State
- Published
- Severity
- Not scored
- Published
- Jul 10, 2018
- Updated
- Sep 16, 2024
- Reserved
- Dec 4, 2017
Description
It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to ceph cluster network who is able to sniff packets on network can use this vulnerability to authenticate with ceph service and perform actions allowed by ceph service. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable.
Scores
The record has no CVSS score.
Weaknesses
Affected Products
| Product | Versions |
|---|---|
cephRed Hat, Inc. |
|
References
- RHSA-2018:2261vendor-advisory
- RHSA-2018:2177vendor-advisory
- https://github.com/ceph/ceph/commit/5ead97120e07054d80623dada90a5cc764c28468
- RHSA-2018:2179vendor-advisory
- RHSA-2018:2274vendor-advisory
- DSA-4339vendor-advisory
- [debian-lts-announce] 20190315 [SECURITY] [DLA 1715-1] linux-4.9 security updatemailing-list
- http://tracker.ceph.com/issues/24836
- https://bugzilla.redhat.com/show_bug.cgi?id=1575866
- openSUSE-SU-2019:1284vendor-advisory
- [oss-security] 20201117 CVE-2020-25677 ceph: CEPHX_V2 replay attack protection lostmailing-list
- [oss-security] 20201117 Re: CVE-2020-25677 ceph: CEPHX_V2 replay attack protection lostmailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.