Medium severity · published Jul 10, 2018
CVE-2018-1129
A flaw was found in the way signature calculation was handled by cephx authentication protocol
6.5
CVSS
1.9%
EPSS
No
On KEV
Description
A flaw was found in the way signature calculation was handled by cephx authentication protocol. An attacker having access to ceph cluster network who is able to alter the message payload was able to bypass signature checks done by cephx protocol. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable.
CVSS vector
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CE
Ceph · Ceph
10.2.0; 10.2.1; 10.2.2; 10.2.3; 10.2.4; 10.2.5; +16 more · source: NVD
CS
Ceph Storage · Redhat
1.3; 3 · source: NVD
CS
Ceph Storage Mon · Redhat
2; 3 · source: NVD
CS
Ceph Storage Osd · Redhat
2; 3 · source: NVD
DL
Debian Linux · Debian
8.0; 9.0 · source: NVD
EL
Enterprise Linux · Redhat
7.0 · source: NVD
EL
Enterprise Linux Desktop · Redhat
7.0 · source: NVD
EL
Enterprise Linux Server · Redhat
7.0 · source: NVD
EL
Enterprise Linux Workstation · Redhat
7.0 · source: NVD
LE
Leap · Opensuse
15.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-1129
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-1129
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00100.html
packetstormsecurity.com
http://packetstormsecurity.com/files/154245/Kernel-Live-Patch-Security-Notice-LSN-0054-1.html
Issue Tracking
http://tracker.ceph.com/issues/24837
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2177
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2179
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2261
More from Ceph
9.1
CVE-2026-50152
Ceph Monitor subscription handler improperly authorizes config-key store reads, exposing cluster secrets to read-only users
8.9
CVE-2025-30156
Ceph: AES-CBC misuse in CephX and RADOSGW enables authentication bypass and credential forgery
8.8
CVE-2026-39944
Ceph: CephX AES Authentication error
8.1
CVE-2026-54330
Ceph RGW SigV4 handler accepts unsigned x-amz-* headers on presigned requests, allowing privilege escalation
8.1
CVE-2018-10861
A flaw was found in the way ceph mon handles user requests