PT-2018-10448 · Red Hat+2 · Ceph+2
Siddharth Sharma
·
Published
2018-07-10
·
Updated
2021-05-27
·
CVE-2018-1128
CVSS v3.1
7.5
High
| Vector | AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Ceph branches master, mimic, luminous, and jewel are believed to be vulnerable.
Description
The cephx authentication protocol did not correctly verify Ceph clients, making it vulnerable to a replay attack. An attacker with access to the Ceph cluster network who can sniff packets can use this issue to authenticate with the Ceph service and perform actions allowed by the service.
Recommendations
For Ceph branches master, mimic, luminous, and jewel, consider restricting access to the Ceph cluster network to minimize the risk of exploitation until a fix is available.
As a temporary workaround, review and enhance the authentication mechanisms to prevent replay attacks.
Restrict actions allowed by the Ceph service to minimize potential damage from unauthorized access.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Improper Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Ceph
Suse