Red Hat Security Advisory

RHSA-2018:2177

Red Hat Ceph Storage 3.0 security and bug fix update

Released 2018-07-11 · Red Hat rating Moderate · View on Red Hat →

Fixed in

7Server-RHCEPH-3.0-MON ceph-2:12.2.4-30.el7cp, ceph-base-2:12.2.4-30.el7cp, ceph-common-2:12.2.4-30.el7cp +19
7Server-RHCEPH-3.0-OSD ceph-2:12.2.4-30.el7cp, ceph-base-2:12.2.4-30.el7cp, ceph-common-2:12.2.4-30.el7cp +18
7Server-RHCEPH-3.0-Tools ceph-2:12.2.4-30.el7cp, ceph-ansible-3.0.39-1.el7cp, ceph-base-2:12.2.4-30.el7cp +26

TI-2018-07675 CVE-2018-10861 · GHSA-58jc-hvg4-pxxm

MEDIUM 41

A flaw was found in the way ceph mon handles user requests.

CVSS 3.0HIGH 8.1 Network Low privileges No interaction EPSS 0.03181 Published 2018-07-10 Fixed CWE-285

TI-2018-01045 CVE-2018-1128 · GHSA-xw3f-9qfw-v43f

LOW 36

It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack.

CVSS 3.0HIGH 7.5 Adjacent network No auth No interaction EPSS 0.01386 Published 2018-07-10 Partial fix CWE-294

TI-2018-01046 CVE-2018-1129 · GHSA-7qc9-w55v-w7p3

LOW 33

A flaw was found in the way signature calculation was handled by cephx authentication protocol.

CVSS 3.0MEDIUM 6.5 Adjacent network No auth No interaction EPSS 0.01902 Published 2018-07-10 Partial fix CWE-284