CVE-2018-10861

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph storage pools and corrupt snapshot images. Ceph branches master, mimic, luminous and jewel are believed to be affected.

Metrics

CVSS 3.0 8.1/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-285 CWE-287

Affected software

Vendor	Product	Versions
Red Hat, Inc.	ceph	all versions in branches master, mimic, luminous and jewel

References

http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00100.htmlThird Party Advisory
http://tracker.ceph.com/issues/24838Issue Tracking, Vendor Advisory
http://www.securityfocus.com/bid/104742Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2018:2177Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2179Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2261Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2274Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1593308Issue Tracking, Patch, Third Party Advisory
https://github.com/ceph/ceph/commit/975528f632f73fbffa3f1fee304e3bbe3296cffcPatch, Third Party Advisory
https://www.debian.org/security/2018/dsa-4339Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00100.htmlThird Party Advisory
http://tracker.ceph.com/issues/24838Issue Tracking, Vendor Advisory
http://www.securityfocus.com/bid/104742Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2018:2177Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2179Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2261Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2274Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1593308Issue Tracking, Patch, Third Party Advisory
https://github.com/ceph/ceph/commit/975528f632f73fbffa3f1fee304e3bbe3296cffcPatch, Third Party Advisory
https://www.debian.org/security/2018/dsa-4339Third Party Advisory

Timeline

Published: Jul 10, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-108625.5WildFly Core before version 6.0.0.Alpha3 does not properly validate file paths in .war archives, allowing for the extraction of crafted .war CVE-2018-108637.5It was discovered that redhat-certification 7 is not properly configured and it lists all files and directories in the /var/www/rhcert/store CVE-2018-108646.2An uncontrolled resource consumption flaw has been discovered in redhat-certification in the way documents are loaded. A remote attacker may CVE-2018-108657.5It was discovered that the /configuration view of redhat-certification 7 does not perform an authorization check and it allows an unauthenti CVE-2018-108669.1It was discovered that the /configuration view of redhat-certification 7 does not perform an authorization check and it allows an unauthenti CVE-2018-108679.1Files are accessible without restrictions from the /update/results page of redhat-certification 7 package, allowing an attacker to remove an CVE-2018-108687.5redhat-certification 7 does not properly restrict the number of recursive definitions of entities in XML documents, allowing an unauthentica CVE-2018-108697.5redhat-certification does not properly restrict files that can be download through the /download page. A remote attacker may download any fi CVE-2018-10877.8kernel KVM before versions kernel 4.16, kernel 4.16-rc7, kernel 4.17-rc1, kernel 4.17-rc2 and kernel 4.17-rc3 is vulnerable to a flaw in the CVE-2018-108709.8redhat-certification does not properly sanitize paths in rhcertStore.py:__saveResultsFile. A remote attacker could use this flaw to overwrit CVE-2018-108717.2389-ds-base before versions 1.3.8.5, 1.4.0.12 is vulnerable to a Cleartext Storage of Sensitive Information. By default, when the Replica an CVE-2018-108725.5A flaw was found in the way the Linux kernel handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions.