CVE-2018-10861 Missing authorization in ceph
Authenticated users with read access can improperly delete or create storage pools and corrupt snapshots due to missing authorization checks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-10861?
CVE-2018-10861 is a high-severity missing authorization vulnerability in Debian Debian Linux, published on 10 Jul 2018. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph storage pools and corrupt snapshot images. Ceph branches master, mimic, luminous and jewel are believed to be affected.
Which versions are affected by CVE-2018-10861?
It affects 9 products.
Products include Ceph Ceph, Debian Debian Linux, Opensuse Leap, Redhat Ceph Storage, Redhat Ceph Storage Mon, Redhat Ceph Storage Osd and 3 more.
How do I fix CVE-2018-10861?
Apply the vendor's patch.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2018-10861 being exploited?
There is no known exploitation of CVE-2018-10861 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2018-10861, GHSA-58jc-hvg4-pxxm, UBUNTU-CVE-2018-10861.