Read the docs
TI-2018-01046 Aliases CVE-2018-1129GHSA-7qc9-w55v-w7p3

Improper access control in Red Hat ceph

Priority LOW 33CWE-284Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 11 fixed, 2 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-284.

Summary

A flaw was found in the way signature calculation was handled by cephx authentication protocol. An attacker having access to ceph cluster network who is able to alter the message payload was able to bypass signature checks done by cephx protocol. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable.

Why it matters now

EPSS 0.01902 79th percentileScored 2026-11-07
Fix Partial Red Hat: 4 advisoriesRed Hat: 11 fixed, 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red Hatcephall versions in branches master, mimic, luminous and jewel—No fix listedCNA
  • ceph VendorRed Hat Affected all versions in branches master, mimic, luminous and jewel Fixed in — No fix listed CNA

CPE configurations NVD · 35

CPEVersionsRoleVendor
cpe:2.3:a:redhat:ceph_storage:1.3:*:*:*:*:*:*:*1.3VulnerableRed Hat
cpe:2.3:a:redhat:ceph_storage:3:*:*:*:*:*:*:*3VulnerableRed Hat
cpe:2.3:a:redhat:ceph_storage_mon:2:*:*:*:*:*:*:*2VulnerableRed Hat
cpe:2.3:a:redhat:ceph_storage_mon:3:*:*:*:*:*:*:*3VulnerableRed Hat
cpe:2.3:a:redhat:ceph_storage_osd:2:*:*:*:*:*:*:*2VulnerableRed Hat
cpe:2.3:a:redhat:ceph_storage_osd:3:*:*:*:*:*:*:*3VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
  • cpe:2.3:a:redhat:ceph_storage:1.3:*:*:*:*:*:*:* Versions 1.3 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:ceph_storage:3:*:*:*:*:*:*:* Versions 3 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:ceph_storage_mon:2:*:*:*:*:*:*:* Versions 2 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:ceph_storage_mon:3:*:*:*:*:*:*:* Versions 3 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:ceph_storage_osd:2:*:*:*:*:*:*:* Versions 2 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:ceph_storage_osd:3:*:*:*:*:*:*:* Versions 3 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
Show 25 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:ceph:ceph:10.2.0:*:*:*:*:*:*:*10.2.0Vulnerableceph
cpe:2.3:a:ceph:ceph:10.2.1:*:*:*:*:*:*:*10.2.1Vulnerableceph
cpe:2.3:a:ceph:ceph:10.2.2:*:*:*:*:*:*:*10.2.2Vulnerableceph
cpe:2.3:a:ceph:ceph:10.2.3:*:*:*:*:*:*:*10.2.3Vulnerableceph
cpe:2.3:a:ceph:ceph:10.2.4:*:*:*:*:*:*:*10.2.4Vulnerableceph
cpe:2.3:a:ceph:ceph:10.2.5:*:*:*:*:*:*:*10.2.5Vulnerableceph
cpe:2.3:a:ceph:ceph:10.2.6:*:*:*:*:*:*:*10.2.6Vulnerableceph
cpe:2.3:a:ceph:ceph:10.2.7:*:*:*:*:*:*:*10.2.7Vulnerableceph
cpe:2.3:a:ceph:ceph:10.2.8:*:*:*:*:*:*:*10.2.8Vulnerableceph
cpe:2.3:a:ceph:ceph:10.2.9:*:*:*:*:*:*:*10.2.9Vulnerableceph
cpe:2.3:a:ceph:ceph:10.2.10:*:*:*:*:*:*:*10.2.10Vulnerableceph
cpe:2.3:a:ceph:ceph:10.2.11:*:*:*:*:*:*:*10.2.11Vulnerableceph
cpe:2.3:a:ceph:ceph:12.2.0:*:*:*:*:*:*:*12.2.0Vulnerableceph
cpe:2.3:a:ceph:ceph:12.2.1:*:*:*:*:*:*:*12.2.1Vulnerableceph
cpe:2.3:a:ceph:ceph:12.2.2:*:*:*:*:*:*:*12.2.2Vulnerableceph
cpe:2.3:a:ceph:ceph:12.2.3:*:*:*:*:*:*:*12.2.3Vulnerableceph
cpe:2.3:a:ceph:ceph:12.2.4:*:*:*:*:*:*:*12.2.4Vulnerableceph
cpe:2.3:a:ceph:ceph:12.2.5:*:*:*:*:*:*:*12.2.5Vulnerableceph
cpe:2.3:a:ceph:ceph:12.2.6:*:*:*:*:*:*:*12.2.6Vulnerableceph
cpe:2.3:a:ceph:ceph:12.2.7:*:*:*:*:*:*:*12.2.7Vulnerableceph
cpe:2.3:a:ceph:ceph:13.2.0:*:*:*:*:*:*:*13.2.0Vulnerableceph
cpe:2.3:a:ceph:ceph:13.2.1:*:*:*:*:*:*:*13.2.1Vulnerableceph
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*8.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*15.0VulnerableopenSUSE
  • cpe:2.3:a:ceph:ceph:10.2.0:*:*:*:*:*:*:* Versions 10.2.0 Vulnerable ·ceph
  • cpe:2.3:a:ceph:ceph:10.2.1:*:*:*:*:*:*:* Versions 10.2.1 Vulnerable ·ceph
  • cpe:2.3:a:ceph:ceph:10.2.2:*:*:*:*:*:*:* Versions 10.2.2 Vulnerable ·ceph
  • cpe:2.3:a:ceph:ceph:10.2.3:*:*:*:*:*:*:* Versions 10.2.3 Vulnerable ·ceph
  • cpe:2.3:a:ceph:ceph:10.2.4:*:*:*:*:*:*:* Versions 10.2.4 Vulnerable ·ceph
  • cpe:2.3:a:ceph:ceph:10.2.5:*:*:*:*:*:*:* Versions 10.2.5 Vulnerable ·ceph
  • cpe:2.3:a:ceph:ceph:10.2.6:*:*:*:*:*:*:* Versions 10.2.6 Vulnerable ·ceph
  • cpe:2.3:a:ceph:ceph:10.2.7:*:*:*:*:*:*:* Versions 10.2.7 Vulnerable ·ceph
  • cpe:2.3:a:ceph:ceph:10.2.8:*:*:*:*:*:*:* Versions 10.2.8 Vulnerable ·ceph
  • cpe:2.3:a:ceph:ceph:10.2.9:*:*:*:*:*:*:* Versions 10.2.9 Vulnerable ·ceph
  • cpe:2.3:a:ceph:ceph:10.2.10:*:*:*:*:*:*:* Versions 10.2.10 Vulnerable ·ceph
  • cpe:2.3:a:ceph:ceph:10.2.11:*:*:*:*:*:*:* Versions 10.2.11 Vulnerable ·ceph
  • cpe:2.3:a:ceph:ceph:12.2.0:*:*:*:*:*:*:* Versions 12.2.0 Vulnerable ·ceph
  • cpe:2.3:a:ceph:ceph:12.2.1:*:*:*:*:*:*:* Versions 12.2.1 Vulnerable ·ceph
  • cpe:2.3:a:ceph:ceph:12.2.2:*:*:*:*:*:*:* Versions 12.2.2 Vulnerable ·ceph
  • cpe:2.3:a:ceph:ceph:12.2.3:*:*:*:*:*:*:* Versions 12.2.3 Vulnerable ·ceph
  • cpe:2.3:a:ceph:ceph:12.2.4:*:*:*:*:*:*:* Versions 12.2.4 Vulnerable ·ceph
  • cpe:2.3:a:ceph:ceph:12.2.5:*:*:*:*:*:*:* Versions 12.2.5 Vulnerable ·ceph
  • cpe:2.3:a:ceph:ceph:12.2.6:*:*:*:*:*:*:* Versions 12.2.6 Vulnerable ·ceph
  • cpe:2.3:a:ceph:ceph:12.2.7:*:*:*:*:*:*:* Versions 12.2.7 Vulnerable ·ceph
  • cpe:2.3:a:ceph:ceph:13.2.0:*:*:*:*:*:*:* Versions 13.2.0 Vulnerable ·ceph
  • cpe:2.3:a:ceph:ceph:13.2.1:*:*:*:*:*:*:* Versions 13.2.1 Vulnerable ·ceph
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·openSUSE

Remediation

Red Hat 4 advisories

  • RHSA-2018:2261 Released 2018-07-26 · Red Hat rating Moderate
    Red Hat Ceph Storage 2.5 security, enhancement, and bug fix update
    • 7Client-RHCEPH-2.5-Client-Tools ceph-2:10.2.10-28.el7cp, ceph-ansible-3.0.39-1.el7cp, ceph-base-2:10.2.10-28.el7cp +17
    • 7ComputeNode-RHCEPH-2.5-ComputeNode-Tools ceph-2:10.2.10-28.el7cp, ceph-ansible-3.0.39-1.el7cp, ceph-base-2:10.2.10-28.el7cp +17
    • 7Server-RHCEPH-2.5-MON ceph-2:10.2.10-28.el7cp, ceph-base-2:10.2.10-28.el7cp, ceph-common-2:10.2.10-28.el7cp +14
    • 7Server-RHCEPH-2.5-OSD ceph-2:10.2.10-28.el7cp, ceph-base-2:10.2.10-28.el7cp, ceph-common-2:10.2.10-28.el7cp +14
    • 7Server-RHCEPH-2.5-Server-Tools ceph-2:10.2.10-28.el7cp, ceph-ansible-3.0.39-1.el7cp, ceph-base-2:10.2.10-28.el7cp +17
    • 7Workstation-RHCEPH-2.5-Workstation-Tools ceph-2:10.2.10-28.el7cp, ceph-ansible-3.0.39-1.el7cp, ceph-base-2:10.2.10-28.el7cp +17
  • RHSA-2018:2274 Released 2018-07-26 · Red Hat rating Moderate
    Red Hat Ceph Storage 2.5 security, enhancement, and bug fix update
    • Red Hat Ceph Storage 2 for Ubuntu
  • RHSA-2018:2179 Released 2018-07-11 · Red Hat rating Moderate
    Red Hat Ceph Storage 3.0 security and bug fix update
    • Red Hat Ceph Storage 3 for Ubuntu
Show 1 more Red Hat advisories
  • RHSA-2018:2177 Released 2018-07-11 · Red Hat rating Moderate
    Red Hat Ceph Storage 3.0 security and bug fix update
    • 7Server-RHCEPH-3.0-MON ceph-2:12.2.4-30.el7cp, ceph-base-2:12.2.4-30.el7cp, ceph-common-2:12.2.4-30.el7cp +19
    • 7Server-RHCEPH-3.0-OSD ceph-2:12.2.4-30.el7cp, ceph-base-2:12.2.4-30.el7cp, ceph-common-2:12.2.4-30.el7cp +18
    • 7Server-RHCEPH-3.0-Tools ceph-2:12.2.4-30.el7cp, ceph-ansible-3.0.39-1.el7cp, ceph-base-2:12.2.4-30.el7cp +26

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Red Hat ceph — RHSA-2018:2177

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2018-07675 Improper authorization in Red Hat cephPriority MEDIUM 41
    • TI-2018-01045 Authentication bypass by capture-replay in Red Hat cephPriority LOW 36
    Show all 3 records → Advisory →
  • Advisory ·

    Red Hat ceph — RHSA-2018:2179

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2018-07675 Improper authorization in Red Hat cephPriority MEDIUM 41
    • TI-2018-01045 Authentication bypass by capture-replay in Red Hat cephPriority LOW 36
    Show all 3 records → Advisory →
Show 3 more groups
  • Advisory ·

    Red Hat ceph — RHSA-2018:2261

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2018-07675 Improper authorization in Red Hat cephPriority MEDIUM 41
    • TI-2018-01045 Authentication bypass by capture-replay in Red Hat cephPriority LOW 36
    Show all 3 records → Advisory →
  • Advisory ·

    Red Hat ceph — RHSA-2018:2274

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2018-07675 Improper authorization in Red Hat cephPriority MEDIUM 41
    • TI-2018-01045 Authentication bypass by capture-replay in Red Hat cephPriority LOW 36
    Show all 3 records → Advisory →
  • Advisory ·

    Red Hat ceph — DSA-4339

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2018-07675 Improper authorization in Red Hat cephPriority MEDIUM 41
    • TI-2018-01045 Authentication bypass by capture-replay in Red Hat cephPriority LOW 36
    Show all 3 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ceph Storage 1.3AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
7Client-RHCEPH-2.5-Client-ToolsFixed RHSA-2018:2261
7ComputeNode-RHCEPH-2.5-ComputeNode-ToolsFixed RHSA-2018:2261
7Server-RHCEPH-2.5-MONFixed RHSA-2018:2261
7Server-RHCEPH-2.5-OSDFixed RHSA-2018:2261
7Server-RHCEPH-2.5-Server-ToolsFixed RHSA-2018:2261
7Server-RHCEPH-3.0-MONFixed RHSA-2018:2177
7Server-RHCEPH-3.0-OSDFixed RHSA-2018:2177
7Server-RHCEPH-3.0-ToolsFixed RHSA-2018:2177
7Workstation-RHCEPH-2.5-Workstation-ToolsFixed RHSA-2018:2261
Red Hat Ceph Storage 2 for UbuntuFixed RHSA-2018:2274
Red Hat Ceph Storage 3 for UbuntuFixed RHSA-2018:2179
Not affected: 1 product
  • Red Hat Enterprise Linux 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-1129
  2. 2026-10-03 Alias added: GHSA-7qc9-w55v-w7p3

References

Patch 2

Advisory 8

Other 1

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2018-11213 Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass… CVSS 3.0CRITICAL 9.8
  • TI-2022-09605 An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. CVSS 3.1CRITICAL 9.8
  • TI-2025-13566 Nodemailer: nodemailer: denial of service via crafted email address header CVSS 3.1HIGH 7.5
  • TI-2026-28834 jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers CVSS 4.0MEDIUM 6.9
  • TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
See all 45 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences