Read the docs
TI-2018-01045 Aliases CVE-2018-1128GHSA-xw3f-9qfw-v43f

Authentication bypass by capture-replay in Red Hat ceph

Priority LOW 36CWE-294Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 11 fixed, 3 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-294.

Summary

It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to ceph cluster network who is able to sniff packets on network can use this vulnerability to authenticate with ceph service and perform actions allowed by ceph service. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable.

Why it matters now

EPSS 0.01386 72nd percentileScored 2026-11-07
Fix Partial Red Hat: 4 advisoriesRed Hat: 11 fixed, 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatcephAll versions in branches master, mimic, luminous and jewel—No fix listedCNA
  • ceph VendorRed Hat Affected All versions in branches master, mimic, luminous and jewel Fixed in — No fix listed CNA

CPE configurations NVD · 13

CPEVersionsRoleVendor
cpe:2.3:a:redhat:ceph_storage:3:*:*:*:*:*:*:*3VulnerableRed Hat
cpe:2.3:a:redhat:ceph_storage_mon:2:*:*:*:*:*:*:*2VulnerableRed Hat
cpe:2.3:a:redhat:ceph_storage_mon:3:*:*:*:*:*:*:*3VulnerableRed Hat
cpe:2.3:a:redhat:ceph_storage_osd:2:*:*:*:*:*:*:*2VulnerableRed Hat
cpe:2.3:a:redhat:ceph_storage_osd:3:*:*:*:*:*:*:*3VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:a:redhat:ceph:*:*:*:*:*:*:*:*10.2.0 – 13.2.1VulnerableRed Hat
  • cpe:2.3:a:redhat:ceph_storage:3:*:*:*:*:*:*:* Versions 3 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:ceph_storage_mon:2:*:*:*:*:*:*:* Versions 2 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:ceph_storage_mon:3:*:*:*:*:*:*:* Versions 3 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:ceph_storage_osd:2:*:*:*:*:*:*:* Versions 2 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:ceph_storage_osd:3:*:*:*:*:*:*:* Versions 3 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:ceph:*:*:*:*:*:*:*:* Versions 10.2.0 – 13.2.1 Vulnerable ·Red Hat
Show 3 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*8.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*15.0VulnerableopenSUSE
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·openSUSE

Remediation

Red Hat 4 advisories

  • RHSA-2018:2261 Released 2018-07-26 · Red Hat rating Moderate
    Red Hat Ceph Storage 2.5 security, enhancement, and bug fix update
    • 7Client-RHCEPH-2.5-Client-Tools ceph-2:10.2.10-28.el7cp, ceph-ansible-3.0.39-1.el7cp, ceph-base-2:10.2.10-28.el7cp +17
    • 7ComputeNode-RHCEPH-2.5-ComputeNode-Tools ceph-2:10.2.10-28.el7cp, ceph-ansible-3.0.39-1.el7cp, ceph-base-2:10.2.10-28.el7cp +17
    • 7Server-RHCEPH-2.5-MON ceph-2:10.2.10-28.el7cp, ceph-base-2:10.2.10-28.el7cp, ceph-common-2:10.2.10-28.el7cp +14
    • 7Server-RHCEPH-2.5-OSD ceph-2:10.2.10-28.el7cp, ceph-base-2:10.2.10-28.el7cp, ceph-common-2:10.2.10-28.el7cp +14
    • 7Server-RHCEPH-2.5-Server-Tools ceph-2:10.2.10-28.el7cp, ceph-ansible-3.0.39-1.el7cp, ceph-base-2:10.2.10-28.el7cp +17
    • 7Workstation-RHCEPH-2.5-Workstation-Tools ceph-2:10.2.10-28.el7cp, ceph-ansible-3.0.39-1.el7cp, ceph-base-2:10.2.10-28.el7cp +17
  • RHSA-2018:2274 Released 2018-07-26 · Red Hat rating Moderate
    Red Hat Ceph Storage 2.5 security, enhancement, and bug fix update
    • Red Hat Ceph Storage 2 for Ubuntu
  • RHSA-2018:2179 Released 2018-07-11 · Red Hat rating Moderate
    Red Hat Ceph Storage 3.0 security and bug fix update
    • Red Hat Ceph Storage 3 for Ubuntu
Show 1 more Red Hat advisories
  • RHSA-2018:2177 Released 2018-07-11 · Red Hat rating Moderate
    Red Hat Ceph Storage 3.0 security and bug fix update
    • 7Server-RHCEPH-3.0-MON ceph-2:12.2.4-30.el7cp, ceph-base-2:12.2.4-30.el7cp, ceph-common-2:12.2.4-30.el7cp +19
    • 7Server-RHCEPH-3.0-OSD ceph-2:12.2.4-30.el7cp, ceph-base-2:12.2.4-30.el7cp, ceph-common-2:12.2.4-30.el7cp +18
    • 7Server-RHCEPH-3.0-Tools ceph-2:12.2.4-30.el7cp, ceph-ansible-3.0.39-1.el7cp, ceph-base-2:12.2.4-30.el7cp +26

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Red Hat ceph — RHSA-2018:2177

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2018-07675 Improper authorization in Red Hat cephPriority MEDIUM 41
    • TI-2018-01046 Improper access control in Red Hat cephPriority LOW 33
    Show all 3 records → Advisory →
  • Advisory ·

    Red Hat ceph — RHSA-2018:2179

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2018-07675 Improper authorization in Red Hat cephPriority MEDIUM 41
    • TI-2018-01046 Improper access control in Red Hat cephPriority LOW 33
    Show all 3 records → Advisory →
Show 3 more groups
  • Advisory ·

    Red Hat ceph — RHSA-2018:2261

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2018-07675 Improper authorization in Red Hat cephPriority MEDIUM 41
    • TI-2018-01046 Improper access control in Red Hat cephPriority LOW 33
    Show all 3 records → Advisory →
  • Advisory ·

    Red Hat ceph — RHSA-2018:2274

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2018-07675 Improper authorization in Red Hat cephPriority MEDIUM 41
    • TI-2018-01046 Improper access control in Red Hat cephPriority LOW 33
    Show all 3 records → Advisory →
  • Advisory ·

    Red Hat ceph — DSA-4339

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2018-07675 Improper authorization in Red Hat cephPriority MEDIUM 41
    • TI-2018-01046 Improper access control in Red Hat cephPriority LOW 33
    Show all 3 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ceph Storage 1.3AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Will not fix
7Client-RHCEPH-2.5-Client-ToolsFixed RHSA-2018:2261
7ComputeNode-RHCEPH-2.5-ComputeNode-ToolsFixed RHSA-2018:2261
7Server-RHCEPH-2.5-MONFixed RHSA-2018:2261
7Server-RHCEPH-2.5-OSDFixed RHSA-2018:2261
7Server-RHCEPH-2.5-Server-ToolsFixed RHSA-2018:2261
7Server-RHCEPH-3.0-MONFixed RHSA-2018:2177
7Server-RHCEPH-3.0-OSDFixed RHSA-2018:2177
7Server-RHCEPH-3.0-ToolsFixed RHSA-2018:2177
7Workstation-RHCEPH-2.5-Workstation-ToolsFixed RHSA-2018:2261
Red Hat Ceph Storage 2 for UbuntuFixed RHSA-2018:2274
Red Hat Ceph Storage 3 for UbuntuFixed RHSA-2018:2179
Not affected: 1 product
  • Red Hat Enterprise Linux 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-1128
  2. 2026-10-03 Alias added: GHSA-xw3f-9qfw-v43f

References

Patch 2

Advisory 8

Other 2

  • TI-2024-32120 RGW DoS attack with empty HTTP header in S3 object copy CVSS 3.1HIGH 7.5
  • TI-2020-15677 Authentication bypass by capture-replay in ceph CVSS 3.1HIGH 8.8
  • TI-2018-05266 In Ceph before 12.2.3 and 13.x through 13.0.1, the rgw_civetweb.cc RGWCivetWeb::init_env… CVSS 3.0HIGH 7.5
  • TI-2022-03356 A privilege escalation flaw was found in Ceph. CVSS 3.1HIGH 7.8
  • TI-2018-12099 Sensitive information in log files in ceph CVSS 3.0HIGH 7.5
  • TI-2016-04329 The handle_command function in mon/Monitor.cc in Ceph allows remote authenticated users… CVSS 3.0MEDIUM 6.5
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences