Vulnerability Description
A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph storage pools and corrupt snapshot images. Ceph branches master, mimic, luminous and jewel are believed to be affected.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ceph | Ceph | 10.2.0 |
| Redhat | Ceph Storage | 3 |
| Redhat | Ceph Storage Mon | 2 |
| Redhat | Ceph Storage Osd | 2 |
| Redhat | Enterprise Linux Desktop | 7.0 |
| Redhat | Enterprise Linux Server | 7.0 |
| Redhat | Enterprise Linux Workstation | 7.0 |
| Opensuse | Leap | 15.0 |
| Debian | Debian Linux | 9.0 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00100.htmlThird Party Advisory
- http://tracker.ceph.com/issues/24838Issue TrackingVendor Advisory
- http://www.securityfocus.com/bid/104742Third Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2018:2177Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2179Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2261Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2274Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1593308Issue TrackingPatchThird Party Advisory
- https://github.com/ceph/ceph/commit/975528f632f73fbffa3f1fee304e3bbe3296cffcPatchThird Party Advisory
- https://www.debian.org/security/2018/dsa-4339Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00100.htmlThird Party Advisory
- http://tracker.ceph.com/issues/24838Issue TrackingVendor Advisory
- http://www.securityfocus.com/bid/104742Third Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2018:2177Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2179Third Party Advisory
FAQ
What is CVE-2018-10861?
CVE-2018-10861 is a vulnerability with a CVSS score of 8.1 (HIGH). A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph storage pools and corrupt snapshot images. Ceph branches mast...
How severe is CVE-2018-10861?
CVE-2018-10861 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-10861?
Check the references section above for vendor advisories and patch information. Affected products include: Ceph Ceph, Redhat Ceph Storage, Redhat Ceph Storage Mon, Redhat Ceph Storage Osd, Redhat Enterprise Linux Desktop.