Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2018-10861

A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph storage pools and corrupt snapshot images. Ceph branches master, mimic, luminous and jewel are believed to be affected.

Published

2018-07-10T14:29:00.213

Last Modified

2024-11-21T03:42:09.890

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 8.1 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:N/I:P/A:P

Access Vector: NETWORK
Access Complexity: LOW
Authentication: SINGLE
Confidentiality Impact: NONE
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

8.0

Impact Score

4.9

Weaknesses

Type: Secondary
CWE-285
Type: Primary
CWE-287

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	ceph	ceph	10.2.0	Yes
Application	ceph	ceph	10.2.1	Yes
Application	ceph	ceph	10.2.2	Yes
Application	ceph	ceph	10.2.3	Yes
Application	ceph	ceph	10.2.4	Yes
Application	ceph	ceph	10.2.5	Yes
Application	ceph	ceph	10.2.6	Yes
Application	ceph	ceph	10.2.7	Yes
Application	ceph	ceph	10.2.8	Yes
Application	ceph	ceph	10.2.9	Yes
Application	ceph	ceph	10.2.10	Yes
Application	ceph	ceph	10.2.11	Yes
Application	ceph	ceph	12.2.0	Yes
Application	ceph	ceph	12.2.1	Yes
Application	ceph	ceph	12.2.2	Yes
Application	ceph	ceph	12.2.3	Yes
Application	ceph	ceph	12.2.4	Yes
Application	ceph	ceph	12.2.5	Yes
Application	ceph	ceph	12.2.6	Yes
Application	ceph	ceph	12.2.7	Yes
Application	ceph	ceph	13.2.0	Yes
Application	ceph	ceph	13.2.1	Yes
Application	redhat	ceph_storage	3	Yes
Application	redhat	ceph_storage_mon	2	Yes
Application	redhat	ceph_storage_mon	3	Yes
Application	redhat	ceph_storage_osd	2	Yes
Application	redhat	ceph_storage_osd	3	Yes
Operating System	redhat	enterprise_linux_desktop	7.0	Yes
Operating System	redhat	enterprise_linux_server	7.0	Yes
Operating System	redhat	enterprise_linux_workstation	7.0	Yes
Operating System	opensuse	leap	15.0	Yes
Operating System	debian	debian_linux	9.0	Yes

References

http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00100.html Third Party Advisory ([email protected])
http://tracker.ceph.com/issues/24838 Issue Tracking, Vendor Advisory ([email protected])
http://www.securityfocus.com/bid/104742 Third Party Advisory, VDB Entry ([email protected])
https://access.redhat.com/errata/RHSA-2018:2177 Third Party Advisory ([email protected])
https://access.redhat.com/errata/RHSA-2018:2179 Third Party Advisory ([email protected])
https://access.redhat.com/errata/RHSA-2018:2261 Third Party Advisory ([email protected])
https://access.redhat.com/errata/RHSA-2018:2274 Third Party Advisory ([email protected])
https://bugzilla.redhat.com/show_bug.cgi?id=1593308 Issue Tracking, Patch, Third Party Advisory ([email protected])
https://github.com/ceph/ceph/commit/975528f632f73fbffa3f1fee304e3bbe3296cffc Patch, Third Party Advisory ([email protected])
https://www.debian.org/security/2018/dsa-4339 Third Party Advisory ([email protected])
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00100.html Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://tracker.ceph.com/issues/24838 Issue Tracking, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/104742 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://access.redhat.com/errata/RHSA-2018:2177 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://access.redhat.com/errata/RHSA-2018:2179 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://access.redhat.com/errata/RHSA-2018:2261 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://access.redhat.com/errata/RHSA-2018:2274 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://bugzilla.redhat.com/show_bug.cgi?id=1593308 Issue Tracking, Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/ceph/ceph/commit/975528f632f73fbffa3f1fee304e3bbe3296cffc Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.debian.org/security/2018/dsa-4339 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)