CVE-2018-14649

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

It was found that ceph-isci-cli package as shipped by Red Hat Ceph Storage 2 and 3 is using python-werkzeug in debug shell mode. This is done by setting debug=True in file /usr/bin/rbd-target-api provided by ceph-isci-cli package. This allows unauthenticated attackers to access this debug shell and escalate privileges. Once an attacker has successfully connected to this debug shell they will be able to execute arbitrary commands remotely. These commands will run with the same privileges as of user executing the application which is using python-werkzeug with debug shell mode enabled. In - Red Hat Ceph Storage 2 and 3, ceph-isci-cli package runs python-werkzeug library with root level permissions.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
[UNKNOWN]	ceph-iscsi-cli	n/a

References

http://www.securityfocus.com/bid/105434Third Party Advisory, VDB Entry
https://access.redhat.com/articles/3623521Mitigation, Patch, Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:2837Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:2838Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14649Issue Tracking, Vendor Advisory
https://github.com/ceph/ceph-iscsi-cli/issues/120Exploit, Third Party Advisory
https://github.com/ceph/ceph-iscsi-cli/pull/121/commits/c3812075e30c76a800a961e7291087d357403f6bPatch, Vendor Advisory
http://www.securityfocus.com/bid/105434Third Party Advisory, VDB Entry
https://access.redhat.com/articles/3623521Mitigation, Patch, Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:2837Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:2838Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14649Issue Tracking, Vendor Advisory
https://github.com/ceph/ceph-iscsi-cli/issues/120Exploit, Third Party Advisory
https://github.com/ceph/ceph-iscsi-cli/pull/121/commits/c3812075e30c76a800a961e7291087d357403f6bPatch, Vendor Advisory

Timeline

Published: Oct 9, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-14655.3IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5,CVE-2018-146505.0It was discovered that sos-collector does not properly set the default permissions of newly created files, making all files created by the t CVE-2018-146518.8It was found that the fix for CVE-2018-10927, CVE-2018-10928, CVE-2018-10929, CVE-2018-10930, and CVE-2018-10926 was incomplete. A remote, a CVE-2018-146526.5The Gluster file system through versions 3.12 and 4.1.4 is vulnerable to a buffer overflow in the 'features/index' translator via the code h CVE-2018-146538.8The Gluster file system through versions 4.1.4 and 3.12 is vulnerable to a heap-based buffer overflow in the '__server_getspec' function via CVE-2018-146546.5The Gluster file system through version 4.1.4 is vulnerable to abuse of the 'features/index' translator. A remote attacker with access to mo CVE-2018-146555.4A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final. When using 'response_mode=form_post' it is possible to inject arbitrary CVE-2018-146565.5A missing address check in the callers of the show_opcodes() in the Linux kernel allows an attacker to dump the kernel memory at an arbitrar CVE-2018-146578.1A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final. When TOPT enabled, an improper implementation of the Brute Force detection algorithm CVE-2018-146586.1A flaw was found in JBOSS Keycloak 3.2.1.Final. The Redirect URL for both Login and Logout are not normalized in org.keycloak.protocol.oidc.CVE-2018-146596.5The Gluster file system through versions 4.1.4 and 3.1.2 is vulnerable to a denial of service attack via use of the 'GF_XATTR_IOSTATS_DUMP_K CVE-2018-14665.3IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products (6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5,