Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2018-1128

Опубликовано: 10 июл. 2018
Источник: nvd
CVSS3: 7.5
CVSS2: 5.4
EPSS Низкий

Описание

It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to ceph cluster network who is able to sniff packets on network can use this vulnerability to authenticate with ceph service and perform actions allowed by ceph service. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable.

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:redhat:ceph_storage:3:*:*:*:*:*:*:*
cpe:2.3:a:redhat:ceph_storage_mon:2:*:*:*:*:*:*:*
cpe:2.3:a:redhat:ceph_storage_mon:3:*:*:*:*:*:*:*
cpe:2.3:a:redhat:ceph_storage_osd:2:*:*:*:*:*:*:*
cpe:2.3:a:redhat:ceph_storage_osd:3:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
Конфигурация 2
cpe:2.3:a:redhat:ceph:*:*:*:*:*:*:*:*
Версия от 10.2.0 (включая) до 13.2.1 (включая)
Конфигурация 3

Одно из

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Конфигурация 4
cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*

EPSS

Процентиль: 81%
0.01584
Низкий

7.5 High

CVSS3

5.4 Medium

CVSS2

Дефекты

CWE-294
CWE-287

Связанные уязвимости

CVSS3: 7.5
ubuntu
около 7 лет назад

It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to ceph cluster network who is able to sniff packets on network can use this vulnerability to authenticate with ceph service and perform actions allowed by ceph service. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable.

CVSS3: 5.9
redhat
около 7 лет назад

It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to ceph cluster network who is able to sniff packets on network can use this vulnerability to authenticate with ceph service and perform actions allowed by ceph service. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable.

CVSS3: 7.5
debian
около 7 лет назад

It was found that cephx authentication protocol did not verify ceph cl ...

CVSS3: 7.5
github
больше 3 лет назад

It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to ceph cluster network who is able to sniff packets on network can use this vulnerability to authenticate with ceph service and perform actions allowed by ceph service. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable.

suse-cvrf
около 7 лет назад

Security update for ceph

EPSS

Процентиль: 81%
0.01584
Низкий

7.5 High

CVSS3

5.4 Medium

CVSS2

Дефекты

CWE-294
CWE-287