A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph storage pools and corrupt snapshot images. Ceph branches master, mimic, luminous and jewel are believed to be affected.
| Date Added | Due Date | Vulnerability Name | Required Action |
|---|---|---|---|
| N/A |
| Type | Version | Base score | Base severity | Vector |
|---|---|---|---|---|
| Primary | 3.0 | 8.1 | HIGH | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H |
| Primary | 2.0 | 5.5 | MEDIUM | AV:N/AC:L/Au:S/C:N/I:P/A:P |
| Hyperlink | Source | Resource |
|---|---|---|
| http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00100.html | secalert@redhat.com | Third Party Advisory |
| http://tracker.ceph.com/issues/24838 | secalert@redhat.com | Issue Tracking Vendor Advisory |
| http://www.securityfocus.com/bid/104742 | secalert@redhat.com | Third Party Advisory VDB Entry |
| https://access.redhat.com/errata/RHSA-2018:2177 | secalert@redhat.com | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2018:2179 | secalert@redhat.com | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2018:2261 | secalert@redhat.com | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2018:2274 | secalert@redhat.com | Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=1593308 | secalert@redhat.com | Issue Tracking Patch Third Party Advisory |
| https://github.com/ceph/ceph/commit/975528f632f73fbffa3f1fee304e3bbe3296cffc | secalert@redhat.com | Patch Third Party Advisory |
| https://www.debian.org/security/2018/dsa-4339 | secalert@redhat.com | Third Party Advisory |