CVE-2018-14649

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2018-14649
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-14649.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2018-14649
Downstream
Published
2018-10-09T17:29:01.100Z
Modified
2026-04-02T00:40:24.866055Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

It was found that ceph-isci-cli package as shipped by Red Hat Ceph Storage 2 and 3 is using python-werkzeug in debug shell mode. This is done by setting debug=True in file /usr/bin/rbd-target-api provided by ceph-isci-cli package. This allows unauthenticated attackers to access this debug shell and escalate privileges. Once an attacker has successfully connected to this debug shell they will be able to execute arbitrary commands remotely. These commands will run with the same privileges as of user executing the application which is using python-werkzeug with debug shell mode enabled. In - Red Hat Ceph Storage 2 and 3, ceph-isci-cli package runs python-werkzeug library with root level permissions.

References

Affected packages

Git / github.com/ceph/ceph-iscsi-cli

Affected ranges

Type
GIT
Repo
https://github.com/ceph/ceph-iscsi-cli
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
a4cc87ee9d79ee859922a5a88b5228989794ed14
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.0"
        }
    ]
}

Affected versions

2.*
2.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-14649.json"
unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "7.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "7.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "7.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "3.0"
            }
        ]
    }
]