CVE-2018-1129
- Source
- https://cve.org/CVERecord?id=CVE-2018-1129
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1129.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2018-1129
- Downstream
- Related
- Published
- 2018-07-10T14:29:00.417Z
- Modified
- 2026-07-08T14:13:43.386653Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
- Summary
- [none]
- Details
-
A flaw was found in the way signature calculation was handled by cephx authentication protocol. An attacker having access to ceph cluster network who is able to alter the message payload was able to bypass signature checks done by cephx protocol. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable.
- Database specific
{ "unresolved_ranges": [ { "vendor_product": "debian:debian_linux", "cpes": [ "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "8.0" }, { "last_affected": "8.0" } ], "source": "CPE_STRING" }, { "vendor_product": "redhat:ceph_storage", "cpes": [ "cpe:2.3:a:redhat:ceph_storage:1.3:*:*:*:*:*:*:*", "cpe:2.3:a:redhat:ceph_storage:3:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "1.3" }, { "last_affected": "1.3" }, { "introduced": "3" }, { "last_affected": "3" } ], "source": "CPE_STRING" }, { "vendor_product": "redhat:ceph_storage_mon", "cpes": [ "cpe:2.3:a:redhat:ceph_storage_mon:3:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "3" }, { "last_affected": "3" } ], "source": "CPE_STRING" }, { "vendor_product": "redhat:ceph_storage_osd", "cpes": [ "cpe:2.3:a:redhat:ceph_storage_osd:3:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "3" }, { "last_affected": "3" } ], "source": "CPE_STRING" }, { "vendor_product": "redhat:enterprise_linux", "cpes": [ "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "7.0" }, { "last_affected": "7.0" } ], "source": "CPE_STRING" }, { "vendor_product": "redhat:enterprise_linux_desktop", "cpes": [ "cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "7.0" }, { "last_affected": "7.0" } ], "source": "CPE_STRING" }, { "vendor_product": "redhat:enterprise_linux_server", "cpes": [ "cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "7.0" }, { "last_affected": "7.0" } ], "source": "CPE_STRING" }, { "vendor_product": "redhat:enterprise_linux_workstation", "cpes": [ "cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "7.0" }, { "last_affected": "7.0" } ], "source": "CPE_STRING" } ] }- References
-
- http://packetstormsecurity.com/files/154245/Kernel-Live-Patch-Security-Notice-LSN-0054-1.html
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00100.html
- https://access.redhat.com/errata/RHSA-2018:2177
- https://access.redhat.com/errata/RHSA-2018:2179
- https://access.redhat.com/errata/RHSA-2018:2261
- https://access.redhat.com/errata/RHSA-2018:2274
- https://lists.debian.org/debian-lts-announce/2019/03/msg00017.html
- https://www.debian.org/security/2018/dsa-4339
- http://tracker.ceph.com/issues/24837
- https://bugzilla.redhat.com/show_bug.cgi?id=1576057
- https://github.com/ceph/ceph/commit/8f396cf35a3826044b089141667a196454c0a587
Affected packages
Git / github.com/ceph/ceph
Affected ranges
- Type
- GIT
- Repo
- https://github.com/ceph/ceph
- Events
-
IntroducedLast affectedFixed
- Database specific
-
Show details
{ "cpe": [ "cpe:2.3:a:redhat:ceph_storage_mon:2:*:*:*:*:*:*:*", "cpe:2.3:a:redhat:ceph_storage_osd:2:*:*:*:*:*:*:*", "cpe:2.3:a:ceph:ceph:10.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:ceph:ceph:10.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:ceph:ceph:10.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:ceph:ceph:10.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:ceph:ceph:10.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:ceph:ceph:10.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:ceph:ceph:10.2.6:*:*:*:*:*:*:*", "cpe:2.3:a:ceph:ceph:10.2.7:*:*:*:*:*:*:*", "cpe:2.3:a:ceph:ceph:10.2.8:*:*:*:*:*:*:*", "cpe:2.3:a:ceph:ceph:10.2.9:*:*:*:*:*:*:*", "cpe:2.3:a:ceph:ceph:10.2.10:*:*:*:*:*:*:*", "cpe:2.3:a:ceph:ceph:10.2.11:*:*:*:*:*:*:*", "cpe:2.3:a:ceph:ceph:12.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:ceph:ceph:12.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:ceph:ceph:12.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:ceph:ceph:12.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:ceph:ceph:12.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:ceph:ceph:12.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:ceph:ceph:12.2.6:*:*:*:*:*:*:*", "cpe:2.3:a:ceph:ceph:12.2.7:*:*:*:*:*:*:*", "cpe:2.3:a:ceph:ceph:13.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:ceph:ceph:13.2.1:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*" ], "source": [ "CPE_STRING", "REFERENCES" ], "extracted_events": [ { "introduced": "2" }, { "last_affected": "2" }, { "introduced": "10.2.0" }, { "last_affected": "10.2.0" }, { "introduced": "10.2.1" }, { "last_affected": "10.2.1" }, { "introduced": "10.2.2" }, { "last_affected": "10.2.2" }, { "introduced": "10.2.3" }, { "last_affected": "10.2.3" }, { "introduced": "10.2.4" }, { "last_affected": "10.2.4" }, { "introduced": "10.2.5" }, { "last_affected": "10.2.5" }, { "introduced": "10.2.6" }, { "last_affected": "10.2.6" }, { "introduced": "10.2.7" }, { "last_affected": "10.2.7" }, { "introduced": "10.2.8" }, { "last_affected": "10.2.8" }, { "introduced": "10.2.9" }, { "last_affected": "10.2.9" }, { "introduced": "10.2.10" }, { "last_affected": "10.2.10" }, { "introduced": "10.2.11" }, { "last_affected": "10.2.11" }, { "introduced": "12.2.0" }, { "last_affected": "12.2.0" }, { "introduced": "12.2.1" }, { "last_affected": "12.2.1" }, { "introduced": "12.2.2" }, { "last_affected": "12.2.2" }, { "introduced": "12.2.3" }, { "last_affected": "12.2.3" }, { "introduced": "12.2.4" }, { "last_affected": "12.2.4" }, { "introduced": "12.2.5" }, { "last_affected": "12.2.5" }, { "introduced": "12.2.6" }, { "last_affected": "12.2.6" }, { "introduced": "12.2.7" }, { "last_affected": "12.2.7" }, { "introduced": "13.2.0" }, { "last_affected": "13.2.0" }, { "introduced": "13.2.1" }, { "last_affected": "13.2.1" }, { "introduced": "9.0" }, { "last_affected": "9.0" }, { "introduced": "15.0" }, { "last_affected": "15.0" } ] }
Affected versions
10.*
10.2.0
10.2.1
10.2.10
10.2.11
10.2.2
10.2.3
10.2.4
10.2.5
10.2.6
10.2.7
10.2.8
10.2.9
12.*
12.2.0
12.2.1
12.2.2
12.2.3
12.2.4
12.2.5
12.2.6
12.2.7
13.*
13.2.0
13.2.1
15.*
15.0
Other
2
9.*
9.0
Database specific
vanir_signatures
[
{
"target": {
"file": "src/auth/cephx/CephxSessionHandler.cc"
},
"deprecated": false,
"id": "CVE-2018-1129-692b6d65",
"signature_version": "v1",
"digest": {
"line_hashes": [
"101714054873615671449533678637528044464",
"204730747377763657306045922406037871061",
"184802433459791542385591813469305405696",
"194278290954202200063202169266421026999",
"285463715664107292597185474115337948286",
"224938655615217954667083534808567329747",
"323238405061339438124703828007163250784",
"14757801484515209770633037163635416171",
"299161139125190904871246778424746238226",
"303706062647846700364494057358149497993",
"138165059623664855551085062335377841829",
"68267178292800905880981098471657786013",
"259515854766984647381144657126725459037",
"55799125619598551732393041818857719598",
"173058415040374091877904087060601833097",
"270970690406432738190333471416352672776",
"324432494467839850124208327321842254472",
"81730675890199934822491768895838590587",
"220696923193420841983351434307727546251",
"229605938422456436814419580630024746619",
"168521888538563092444045135638220475818",
"114408788652185594976620226019750969539",
"72228878591817537367041508760725390316",
"274988142511309477226691216762725432855",
"100363914576226021838070188872572478717",
"166929772427402107687685460495313949298",
"180625950686284105336856111568935054618",
"106038062038205489926169328513547198569",
"34436572616374088243955802758804131473",
"171581963407818784950342056701526804311",
"247967641418735543141665557550669436266",
"165244961831484882699473163193719059976"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://github.com/ceph/ceph/commit/8f396cf35a3826044b089141667a196454c0a587"
},
{
"target": {
"file": "src/auth/cephx/CephxSessionHandler.cc",
"function": "CephxSessionHandler::_calc_signature"
},
"deprecated": false,
"id": "CVE-2018-1129-be39d2f8",
"signature_version": "v1",
"digest": {
"function_hash": "31450864465716846747214712719381154708",
"length": 1302.0
},
"signature_type": "Function",
"source": "https://github.com/ceph/ceph/commit/8f396cf35a3826044b089141667a196454c0a587"
}
]
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1129.json"
vanir_signatures_modified
"2026-07-08T14:13:43Z"