Vulnerability Description
It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to ceph cluster network who is able to sniff packets on network can use this vulnerability to authenticate with ceph service and perform actions allowed by ceph service. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Ceph Storage | 3 |
| Redhat | Ceph Storage Mon | 2 |
| Redhat | Ceph Storage Osd | 2 |
| Redhat | Enterprise Linux | 7.0 |
| Redhat | Enterprise Linux Desktop | 7.0 |
| Redhat | Enterprise Linux Server | 7.0 |
| Redhat | Enterprise Linux Workstation | 7.0 |
| Redhat | Ceph | >= 10.2.0, <= 13.2.1 |
| Debian | Debian Linux | 8.0 |
| Opensuse | Leap | 15.0 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00100.htmlThird Party Advisory
- http://tracker.ceph.com/issues/24836Issue TrackingVendor Advisory
- http://www.openwall.com/lists/oss-security/2020/11/17/3
- http://www.openwall.com/lists/oss-security/2020/11/17/4
- https://access.redhat.com/errata/RHSA-2018:2177Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2179Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2261Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2274Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1575866Issue TrackingPatchThird Party Advisory
- https://github.com/ceph/ceph/commit/5ead97120e07054d80623dada90a5cc764c28468PatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/03/msg00017.htmlMailing ListThird Party Advisory
- https://www.debian.org/security/2018/dsa-4339Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00100.htmlThird Party Advisory
- http://tracker.ceph.com/issues/24836Issue TrackingVendor Advisory
- http://www.openwall.com/lists/oss-security/2020/11/17/3
FAQ
What is CVE-2018-1128?
CVE-2018-1128 is a vulnerability with a CVSS score of 7.5 (HIGH). It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to ceph cluster network who is able to sniff packe...
How severe is CVE-2018-1128?
CVE-2018-1128 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-1128?
Check the references section above for vendor advisories and patch information. Affected products include: Redhat Ceph Storage, Redhat Ceph Storage Mon, Redhat Ceph Storage Osd, Redhat Enterprise Linux, Redhat Enterprise Linux Desktop.