PT-2018-10448 · Red Hat+2 · Ceph+2
Siddharth Sharma
·
Publicado
2018-07-10
·
Atualizado
2021-05-27
·
CVE-2018-1128
CVSS v3.1
7.5
Alta
| Vetor | AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Ceph branches master, mimic, luminous, and jewel are believed to be vulnerable.
Description
The cephx authentication protocol did not correctly verify Ceph clients, making it vulnerable to a replay attack. An attacker with access to the Ceph cluster network who can sniff packets can use this issue to authenticate with the Ceph service and perform actions allowed by the service.
Recommendations
For Ceph branches master, mimic, luminous, and jewel, consider restricting access to the Ceph cluster network to minimize the risk of exploitation until a fix is available.
As a temporary workaround, review and enhance the authentication mechanisms to prevent replay attacks.
Restrict actions allowed by the Ceph service to minimize potential damage from unauthorized access.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Improper Authentication
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Ceph
Suse