Red Hat, Inc. ceph
En bref
- Source
- NVD
- EPSS
- EPSS 3.18 % · centile 88 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- redhat
- Statut NVD
- Modified
Rechercher sur…
Description
A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph storage pools and corrupt snapshot images. Ceph branches master, mimic, luminous and jewel are believed to be affected.
Faiblesses (CWE)
Références
- https://access.redhat.com/errata/RHSA-2018:2261
- https://access.redhat.com/errata/RHSA-2018:2177
- https://access.redhat.com/errata/RHSA-2018:2179
- https://access.redhat.com/errata/RHSA-2018:2274
- http://www.securityfocus.com/bid/104742
- https://bugzilla.redhat.com/show_bug.cgi?id=1593308
- https://github.com/ceph/ceph/commit/975528f632f73fbffa3f1fee304e3bbe3296cffc
- https://www.debian.org/security/2018/dsa-4339
- http://tracker.ceph.com/issues/24838
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00100.html
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.0 | HIGH 8.1 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 5.5 | AV:N/AC:L/Au:S/C:N/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2018-2928
- GCVE · GCVE-0-2018-10861
Configurations affectées (CPE NVD)
cpe:2.3:a:ceph:ceph:10.2.0:*:*:*:*:*:*:*cpe:2.3:a:ceph:ceph:10.2.1:*:*:*:*:*:*:*cpe:2.3:a:ceph:ceph:10.2.2:*:*:*:*:*:*:*cpe:2.3:a:ceph:ceph:10.2.3:*:*:*:*:*:*:*cpe:2.3:a:ceph:ceph:10.2.4:*:*:*:*:*:*:*cpe:2.3:a:ceph:ceph:10.2.5:*:*:*:*:*:*:*cpe:2.3:a:ceph:ceph:10.2.6:*:*:*:*:*:*:*cpe:2.3:a:ceph:ceph:10.2.7:*:*:*:*:*:*:*cpe:2.3:a:ceph:ceph:10.2.8:*:*:*:*:*:*:*cpe:2.3:a:ceph:ceph:10.2.9:*:*:*:*:*:*:*cpe:2.3:a:ceph:ceph:10.2.10:*:*:*:*:*:*:*cpe:2.3:a:ceph:ceph:10.2.11:*:*:*:*:*:*:*cpe:2.3:a:ceph:ceph:12.2.0:*:*:*:*:*:*:*cpe:2.3:a:ceph:ceph:12.2.1:*:*:*:*:*:*:*cpe:2.3:a:ceph:ceph:12.2.2:*:*:*:*:*:*:*cpe:2.3:a:ceph:ceph:12.2.3:*:*:*:*:*:*:*cpe:2.3:a:ceph:ceph:12.2.4:*:*:*:*:*:*:*cpe:2.3:a:ceph:ceph:12.2.5:*:*:*:*:*:*:*cpe:2.3:a:ceph:ceph:12.2.6:*:*:*:*:*:*:*cpe:2.3:a:ceph:ceph:12.2.7:*:*:*:*:*:*:*cpe:2.3:a:ceph:ceph:13.2.0:*:*:*:*:*:*:*cpe:2.3:a:ceph:ceph:13.2.1:*:*:*:*:*:*:*cpe:2.3:a:redhat:ceph_storage:3:*:*:*:*:*:*:*cpe:2.3:a:redhat:ceph_storage_mon:2:*:*:*:*:*:*:*cpe:2.3:a:redhat:ceph_storage_mon:3:*:*:*:*:*:*:*cpe:2.3:a:redhat:ceph_storage_osd:2:*:*:*:*:*:*:*cpe:2.3:a:redhat:ceph_storage_osd:3:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| Red Hat, Inc. · ceph | affected all versions in branches master, mimic, luminous and jewel |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |