CVE-2017-16818

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2017-16818
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-16818.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2017-16818
Downstream
Related
Published
2017-12-20T17:29:00.307Z
Modified
2026-04-11T04:14:24.479096Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

RADOS Gateway in Ceph 12.1.0 through 12.2.1 allows remote authenticated users to cause a denial of service (assertion failure and application exit) by leveraging "full" (not necessarily admin) privileges to post an invalid profile to the admin API, related to rgw/rgwiampolicy.cc, rgw/rgwbasictypes.h, and rgw/rgwiamtypes.h.

References

Affected packages

Git / github.com/ceph/ceph

Affected ranges

Type
GIT
Repo
https://github.com/ceph/ceph
Events
Introduced
262617c9f16c55e863693258061c5b25dea5b086
Last affected
3e7492b9ada8bdc9a5cd0feafd42fbca27f9c38e
Fixed
b3118cabb8060a8cc6a01c4e8264cb18e7b1745a
Database specific 
{
    "versions": [
        {
            "introduced": "12.1.0"
        },
        {
            "last_affected": "12.2.1"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-16818.json"
vanir_signatures 
[
    {
        "signature_version": "v1",
        "source": "https://github.com/ceph/ceph/commit/b3118cabb8060a8cc6a01c4e8264cb18e7b1745a",
        "target": {
            "function": "operator==",
            "file": "src/rgw/rgw_iam_policy.h"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "245246725697601185311032149079313535321",
            "length": 274.0
        },
        "signature_type": "Function",
        "id": "CVE-2017-16818-30bd2bc3"
    },
    {
        "signature_version": "v1",
        "source": "https://github.com/ceph/ceph/commit/b3118cabb8060a8cc6a01c4e8264cb18e7b1745a",
        "target": {
            "function": "ARN::parse",
            "file": "src/rgw/rgw_iam_policy.cc"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "115161449127231675261430366954408280182",
            "length": 926.0
        },
        "signature_type": "Function",
        "id": "CVE-2017-16818-5f445548"
    },
    {
        "signature_version": "v1",
        "source": "https://github.com/ceph/ceph/commit/b3118cabb8060a8cc6a01c4e8264cb18e7b1745a",
        "target": {
            "function": "ParseState::do_string",
            "file": "src/rgw/rgw_iam_policy.cc"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "257482042080645969492123703118703426118",
            "length": 2539.0
        },
        "signature_type": "Function",
        "id": "CVE-2017-16818-70864511"
    },
    {
        "signature_version": "v1",
        "source": "https://github.com/ceph/ceph/commit/b3118cabb8060a8cc6a01c4e8264cb18e7b1745a",
        "target": {
            "file": "src/rgw/rgw_iam_policy.cc"
        },
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "146145906752634540765313682605904988138",
                "300545227044232187076135171329259401824",
                "145011432026609021673112281975242102194",
                "231664225983526129193949534530516570064",
                "146682534350213711813353585981002858679",
                "62277682888744214168149015023599555062",
                "328177316986085832359139961185472411234",
                "66482142488496603589659657098125732273",
                "39312891323187369387300176737792469922",
                "40826309220214274116634076047149073606",
                "118751806751612369416559625475932901054",
                "258821612251577066988696007686083167783"
            ],
            "threshold": 0.9
        },
        "signature_type": "Line",
        "id": "CVE-2017-16818-76727305"
    },
    {
        "signature_version": "v1",
        "source": "https://github.com/ceph/ceph/commit/b3118cabb8060a8cc6a01c4e8264cb18e7b1745a",
        "target": {
            "file": "src/rgw/rgw_basic_types.h"
        },
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "262402367343668608787404694791606852720",
                "110205377371365338977776300723008737532",
                "39610461779683595816889888868354529606",
                "60774082359558696122818771212887963030",
                "226592563938730496251934863330508562181",
                "179846860202622419236940311083345258046",
                "295099565652544353016977010409645460648",
                "110617345758211664006391627539065259271"
            ],
            "threshold": 0.9
        },
        "signature_type": "Line",
        "id": "CVE-2017-16818-95488bf6"
    },
    {
        "signature_version": "v1",
        "source": "https://github.com/ceph/ceph/commit/b3118cabb8060a8cc6a01c4e8264cb18e7b1745a",
        "target": {
            "file": "src/rgw/rgw_iam_policy.h"
        },
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "158372427781552240449030411950100469388",
                "217265026761735695146967871697150612868",
                "92137989353602834373249921628343339134",
                "81822642096930447496935148381769194615",
                "320868456820248850273105975750870608543",
                "86899982706742950213335928089327466616",
                "315941269892209884636900773922698834142",
                "56663838429212522112385059210345181007"
            ],
            "threshold": 0.9
        },
        "signature_type": "Line",
        "id": "CVE-2017-16818-d606a597"
    },
    {
        "signature_version": "v1",
        "source": "https://github.com/ceph/ceph/commit/b3118cabb8060a8cc6a01c4e8264cb18e7b1745a",
        "target": {
            "function": "parse_principal",
            "file": "src/rgw/rgw_iam_policy.cc"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "114230751954890269775029335187701073562",
            "length": 1134.0
        },
        "signature_type": "Function",
        "id": "CVE-2017-16818-f32b202f"
    }
]
unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "27"
            }
        ]
    }
]
vanir_signatures_modified 
"2026-04-11T04:14:24Z"