CVE-2018-1129
Summary
| CVE | CVE-2018-1129 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2018-07-10 14:29:00 UTC |
| Updated | 2019-08-29 03:15:00 UTC |
| Description | A flaw was found in the way signature calculation was handled by cephx authentication protocol. An attacker having access to ceph cluster network who is able to alter the message payload was able to bypass signature checks done by cephx protocol. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable. |
Risk And Classification
Problem Types: CWE-287
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Ceph | Ceph | 10.2.0 | All | All | All |
| Application | Ceph | Ceph | 10.2.1 | All | All | All |
| Application | Ceph | Ceph | 10.2.10 | All | All | All |
| Application | Ceph | Ceph | 10.2.11 | All | All | All |
| Application | Ceph | Ceph | 10.2.2 | All | All | All |
| Application | Ceph | Ceph | 10.2.3 | All | All | All |
| Application | Ceph | Ceph | 10.2.4 | All | All | All |
| Application | Ceph | Ceph | 10.2.5 | All | All | All |
| Application | Ceph | Ceph | 10.2.6 | All | All | All |
| Application | Ceph | Ceph | 10.2.7 | All | All | All |
| Application | Ceph | Ceph | 10.2.8 | All | All | All |
| Application | Ceph | Ceph | 10.2.9 | All | All | All |
| Application | Ceph | Ceph | 12.2.0 | All | All | All |
| Application | Ceph | Ceph | 12.2.1 | All | All | All |
| Application | Ceph | Ceph | 12.2.2 | All | All | All |
| Application | Ceph | Ceph | 12.2.3 | All | All | All |
| Application | Ceph | Ceph | 12.2.4 | All | All | All |
| Application | Ceph | Ceph | 12.2.5 | All | All | All |
| Application | Ceph | Ceph | 12.2.6 | All | All | All |
| Application | Ceph | Ceph | 12.2.7 | All | All | All |
| Application | Ceph | Ceph | 13.2.0 | All | All | All |
| Application | Ceph | Ceph | 13.2.1 | All | All | All |
| Application | Ceph | Ceph | 10.2.0 | All | All | All |
| Application | Ceph | Ceph | 10.2.1 | All | All | All |
| Application | Ceph | Ceph | 10.2.10 | All | All | All |
| Application | Ceph | Ceph | 10.2.11 | All | All | All |
| Application | Ceph | Ceph | 10.2.2 | All | All | All |
| Application | Ceph | Ceph | 10.2.3 | All | All | All |
| Application | Ceph | Ceph | 10.2.4 | All | All | All |
| Application | Ceph | Ceph | 10.2.5 | All | All | All |
| Application | Ceph | Ceph | 10.2.6 | All | All | All |
| Application | Ceph | Ceph | 10.2.7 | All | All | All |
| Application | Ceph | Ceph | 10.2.8 | All | All | All |
| Application | Ceph | Ceph | 10.2.9 | All | All | All |
| Application | Ceph | Ceph | 12.2.0 | All | All | All |
| Application | Ceph | Ceph | 12.2.1 | All | All | All |
| Application | Ceph | Ceph | 12.2.2 | All | All | All |
| Application | Ceph | Ceph | 12.2.3 | All | All | All |
| Application | Ceph | Ceph | 12.2.4 | All | All | All |
| Application | Ceph | Ceph | 12.2.5 | All | All | All |
| Application | Ceph | Ceph | 12.2.6 | All | All | All |
| Application | Ceph | Ceph | 12.2.7 | All | All | All |
| Application | Ceph | Ceph | 13.2.0 | All | All | All |
| Application | Ceph | Ceph | 13.2.1 | All | All | All |
| Operating System | Debian | Debian Linux | 8.0 | All | All | All |
| Operating System | Debian | Debian Linux | 9.0 | All | All | All |
| Operating System | Debian | Debian Linux | 8.0 | All | All | All |
| Operating System | Debian | Debian Linux | 9.0 | All | All | All |
| Operating System | Opensuse | Leap | 15.0 | All | All | All |
| Operating System | Opensuse | Leap | 15.0 | All | All | All |
| Application | Redhat | Ceph Storage | 1.3 | All | All | All |
| Application | Redhat | Ceph Storage | 3 | All | All | All |
| Application | Redhat | Ceph Storage | 1.3 | All | All | All |
| Application | Redhat | Ceph Storage | 3 | All | All | All |
| Application | Redhat | Ceph Storage Mon | 2 | All | All | All |
| Application | Redhat | Ceph Storage Mon | 3 | All | All | All |
| Application | Redhat | Ceph Storage Mon | 2 | All | All | All |
| Application | Redhat | Ceph Storage Mon | 3 | All | All | All |
| Application | Redhat | Ceph Storage Osd | 2 | All | All | All |
| Application | Redhat | Ceph Storage Osd | 3 | All | All | All |
| Application | Redhat | Ceph Storage Osd | 2 | All | All | All |
| Application | Redhat | Ceph Storage Osd | 3 | All | All | All |
| Operating System | Redhat | Enterprise Linux | 7.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux | 7.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux Desktop | 7.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux Desktop | 7.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux Server | 7.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux Server | 7.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux Workstation | 7.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux Workstation | 7.0 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Red Hat Customer Portal | REDHAT | access.redhat.com | Third Party Advisory |
| Bug #24837: auth: cephx signature check is weak/broken - RADOS - Ceph | CONFIRM | tracker.ceph.com | Issue Tracking, Vendor Advisory |
| auth/cephx/CephxSessionHandler: implement CEPHX_V2 calculation mode · ceph/ceph@8f396cf · GitHub | CONFIRM | github.com | Patch, Third Party Advisory |
| Red Hat Customer Portal | REDHAT | access.redhat.com | Third Party Advisory |
| [SECURITY] [DLA 1715-1] linux-4.9 security update | MLIST | lists.debian.org | Mailing List, Third Party Advisory |
| [security-announce] openSUSE-SU-2019:1284-1: moderate: Security update f | SUSE | lists.opensuse.org | Third Party Advisory |
| Debian -- Security Information -- DSA-4339-1 ceph | DEBIAN | www.debian.org | Third Party Advisory |
| Red Hat Customer Portal | REDHAT | access.redhat.com | Third Party Advisory |
| 1576057 – (CVE-2018-1129) CVE-2018-1129 ceph: cephx uses weak signatures | CONFIRM | bugzilla.redhat.com | Issue Tracking, Patch, Third Party Advisory |
| Red Hat Customer Portal | REDHAT | access.redhat.com | Third Party Advisory |
| Kernel Live Patch Security Notice LSN-0054-1 ≈ Packet Storm | MISC | packetstormsecurity.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.