Bug 1575866 (CVE-2018-1128)
| Summary: | CVE-2018-1128 ceph: cephx protocol is vulnerable to replay attack | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Siddharth Sharma <sisharma> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | Aron Gunn <agunn> |
| Priority: | medium | ||
| Version: | unspecified | CC: | agunn, branto, danmick, david, dbecker, fedora, gfidente, i, jdurgin, jjoyce, josef, jschluet, kdreyer, kkeithle, lhh, lpeer, mburns, mhicks, ramkrsna, sclewis, security-response-team, sisharma, slinaber, steve, sweil, tserlin, uboppana, yehuda |
| Target Milestone: | --- | Keywords: | Reopened, Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | ceph 10.2.11, ceph 12.2.6, ceph 13.2.1 | Doc Type: | If docs needed, set a value |
| Doc Text: |
It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to the ceph cluster network who is also able to sniff packets on the network can use this vulnerability to authenticate with ceph service and perform actions allowed by ceph service.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-07-24 09:06:55 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2258831, 1576018, 1576019, 1576020, 1599404, 1599406, 1662076 | ||
| Bug Blocks: | 1574281 | ||
|
Description
Siddharth Sharma
2018-05-08 06:35:16 UTC
upstream fix: http://tracker.ceph.com/issues/24836 https://github.com/ceph/ceph/commit/5ead97120e07054d80623dada90a5cc764c28468 Created ceph tracking bugs for this issue: Affects: fedora-all [bug 1599406] This issue has been addressed in the following products: Red Hat Ceph Storage 3.0 for Ubuntu 16.04 Via RHSA-2018:2177 https://access.redhat.com/errata/RHSA-2018:2177 This issue has been addressed in the following products: Red Hat Ceph Storage 3 for Red Hat Enterprise Linux 7 Via RHSA-2018:2179 https://access.redhat.com/errata/RHSA-2018:2179 This issue has been addressed in the following products: Red Hat Ceph Storage 2.5 for Ubuntu 16.04. Via RHSA-2018:2274 https://access.redhat.com/errata/RHSA-2018:2274 This issue has been addressed in the following products: Red Hat Ceph Storage 2 for Red Hat Enterprise Linux 7 Via RHSA-2018:2261 https://access.redhat.com/errata/RHSA-2018:2261 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2018-1128 Statement: Red Hat OpenStack Platform ships the flawed package, however RHOSP deployments use the ceph package directly from the Ceph channel. A RHOSP ceph update will therefore not be provided at this time, but please ensure that the underlying Red Hat Ceph Storage is updated. Fixed upstream in versions: 10.2.11, 12.2.6, and 13.2.1 https://docs.ceph.com/en/latest/releases/jewel/#v10-2-11-jewel https://docs.ceph.com/en/latest/releases/luminous/#v12-2-6-luminous https://docs.ceph.com/en/latest/releases/mimic/#v13-2-1-mimic |