{"id":"CVE-2018-10861","aliases":["DEBIAN-CVE-2018-10861","DSA-4339-1","EUVD-2018-2928","GHSA-58jc-hvg4-pxxm","RHSA-2018:2177","RHSA-2018:2261","SUSE-SU-2018:1920-1","SUSE-SU-2018:2193-1","SUSE-SU-2018:2299-1","SUSE-SU-2018:2478-1","SUSE-SU-2019:0586-1","UBUNTU-CVE-2018-10861","openSUSE-SU-2019:1284-1","openSUSE-SU-2024:10676-1"],"status":"published","title":"A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having...","description":"A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph storage pools and corrupt snapshot images. Ceph branches master, mimic, luminous and jewel are believed to be affected.","severity":{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.03181,"percentile":0.88174,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-285","CWE-287"],"published":"2018-07-10T07:42:02Z","modified":"2026-10-23T18:02:57Z","fixes":[{"ecosystem":"Debian:12","package":"ceph","fixed_in":["12.2.8+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ceph","fixed_in":["12.2.8+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ceph","fixed_in":["12.2.8+dfsg1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.8+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.8+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.8+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2.11-1"}]}],"versions":["10.2.5-7.2","10.2.7-0exp1"],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.4-30.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.4-30.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.4-30.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.4-30.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-mgr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.4-30.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-mon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.4-30.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.4-30.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.4-30.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"cephmetrics","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.1-1.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"cephmetrics-collectors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.1-1.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"libcephfs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.4-30.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"libcephfs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.4-30.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"librados-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.4-30.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"librados2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.4-30.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"libradosstriper1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.4-30.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"librbd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.4-30.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"librbd1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.4-30.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"librgw-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.4-30.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"librgw2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.4-30.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"python-cephfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.4-30.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"python-rados","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.4-30.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"python-rbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.4-30.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"python-rgw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.4-30.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-osd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.4-30.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.39-1.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.4-30.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-mds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.4-30.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-radosgw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.4-30.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"cephmetrics-ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.1-1.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"cephmetrics-grafana-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.1-1.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"nfs-ganesha","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.5-6.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"nfs-ganesha-ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.5-6.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"nfs-ganesha-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.5-6.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"nfs-ganesha-rgw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.5-6.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"rbd-mirror","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.4-30.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:2::el7","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:10.2.10-28.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:2::el7","package":"ceph-ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.39-1.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:2::el7","package":"ceph-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:10.2.10-28.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:2::el7","package":"ceph-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:10.2.10-28.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:2::el7","package":"ceph-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:10.2.10-28.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:2::el7","package":"ceph-fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:10.2.10-28.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:2::el7","package":"ceph-mds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:10.2.10-28.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:2::el7","package":"ceph-radosgw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:10.2.10-28.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:2::el7","package":"ceph-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:10.2.10-28.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:2::el7","package":"libcephfs1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:10.2.10-28.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:2::el7","package":"libcephfs1-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:10.2.10-28.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:2::el7","package":"librados2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:10.2.10-28.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:2::el7","package":"librados2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:10.2.10-28.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:2::el7","package":"librbd1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:10.2.10-28.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:2::el7","package":"librbd1-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:10.2.10-28.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:2::el7","package":"librgw2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:10.2.10-28.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:2::el7","package":"librgw2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:10.2.10-28.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:2::el7","package":"python-cephfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:10.2.10-28.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:2::el7","package":"python-rados","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:10.2.10-28.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:2::el7","package":"python-rbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:10.2.10-28.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:2::el7","package":"rbd-mirror","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:10.2.10-28.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:2::el7","package":"ceph-mon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:10.2.10-28.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:2::el7","package":"ceph-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:10.2.10-28.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:2::el7","package":"ceph-osd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:10.2.10-28.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.5+git.1530082629.8cbf63d997-2.16.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.7+git.1531910353.c0ef85b854-2.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.7+git.1531910353.c0ef85b854-2.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.7+git.1531910353.c0ef85b854-2.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.7+git.1531910353.c0ef85b854-2.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2.11+git.1531487710.3a12911a2e-12.14.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"ceph-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2.11+git.1531487710.3a12911a2e-12.14.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.7+git.1531910353.c0ef85b854-2.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.7+git.1531910353.c0ef85b854-2.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.7+git.1531910353.c0ef85b854-2.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.7+git.1531910353.c0ef85b854-2.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.2.4.125+gad802694f5-3.7.2"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.67.4-0ubuntu2","0.67.4-0ubuntu3","0.72-0ubuntu1","0.72.1-0ubuntu1","0.72.1-2","0.72.1-3","0.72.2-1","0.72.2-2","0.78-0ubuntu1","0.79-0ubuntu1","0.80.1-0ubuntu1","0.80.1-0ubuntu1.1","0.80.5-0ubuntu0.14.04.1","0.80.7-0ubuntu0.14.04.1","0.80.9-0ubuntu0.14.04.1","0.80.9-0ubuntu0.14.04.2","0.80.10-0ubuntu0.14.04.1","0.80.10-0ubuntu1.14.04.2","0.80.10-0ubuntu1.14.04.3","0.80.11-0ubuntu1.14.04.1","0.80.11-0ubuntu1.14.04.2","0.80.11-0ubuntu1.14.04.3","0.80.11-0ubuntu1.14.04.4","0.80.11-0ubuntu1.14.04.4+esm2","0.80.11-0ubuntu1.14.04.4+esm3","0.80.11-0ubuntu1.14.04.4+esm4"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.2.4.125+gad802694f5-lp150.2.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"ceph-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.2.4.125+gad802694f5-lp150.2.3.1"}]}],"bundled":5}],"products":[{"vendor":"ceph","product":"ceph"},{"vendor":"debian","product":"debian_linux"},{"vendor":"opensuse","product":"leap"},{"vendor":"red hat, inc.","product":"ceph"},{"vendor":"redhat","product":"ceph_storage"},{"vendor":"redhat","product":"ceph_storage_mon"},{"vendor":"redhat","product":"ceph_storage_osd"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_workstation"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2018:2261","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2177","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2179","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2274","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/104742","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1593308","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","report"]},{"url":"https://github.com/ceph/ceph/commit/975528f632f73fbffa3f1fee304e3bbe3296cffc","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://www.debian.org/security/2018/dsa-4339","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://tracker.ceph.com/issues/24838","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Vendor Advisory","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00100.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-10861","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-58jc-hvg4-pxxm"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-10861","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1532645","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1534657","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1549004","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1552202","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1552509","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1566016","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1569694","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1570597","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1575024","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1575866","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1576057","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1576861","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1576908","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1577846","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1578509","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1578572","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1579039","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1581403","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1581573","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1585748","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1594974","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1598185","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2177.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1128","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1128","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1128","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1129","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1129","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1129","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-10861","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-10861","tags":["advisory","report"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_ceph_storage/2.5/html/release_notes/bug_fixes","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1448084","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1515341","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1522881","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1548071","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1554963","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1563825","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1568897","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1574231","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1581579","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1584218","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1584763","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1584829","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1595374","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1595383","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1595386","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1599507","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2261.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181920-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1096748","tags":["report"]},{"url":"https://bugzilla.suse.com/1099162","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1129","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182193-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1092874","tags":["report"]},{"url":"https://bugzilla.suse.com/1094932","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182299-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1072512","tags":["report"]},{"url":"https://bugzilla.suse.com/1080112","tags":["report"]},{"url":"https://bugzilla.suse.com/1081379","tags":["report"]},{"url":"https://bugzilla.suse.com/1086340","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7262","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182478-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190586-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1084645","tags":["report"]},{"url":"https://bugzilla.suse.com/1086613","tags":["report"]},{"url":"https://bugzilla.suse.com/1101262","tags":["report"]},{"url":"https://bugzilla.suse.com/1111177","tags":["report"]},{"url":"https://bugzilla.suse.com/1114567","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16846","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-10861","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3PBU365BKTDZHLKZL2NDWGZPNQHYX4IW/#3PBU365BKTDZHLKZL2NDWGZPNQHYX4IW","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1114710","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16889","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10736","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1759","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1760","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20288","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3509","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3524","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3531","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-10861","description":"A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph storage pools and corrupt snapshot images. Ceph branches master, mimic, luminous and jewel are believed to be affected.","status":"published","published":"2018-07-10T14:00:00Z","modified":"2024-09-16T16:28:46.914Z","cwes":["CWE-285"],"updated_at":"2026-11-02T14:35:01.619448Z"}],"euvd":[{"id":"EUVD-2018-2928","description":"A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph storage pools and corrupt snapshot images. Ceph branches master, mimic, luminous and jewel are believed to be affected.","status":"published","published":"2018-07-10T14:00:00Z","modified":"2024-09-16T16:28:46Z","updated_at":"2026-11-03T00:55:51.136895Z"}],"ghsa":[{"id":"GHSA-58jc-hvg4-pxxm","title":"A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having...","description":"A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph storage pools and corrupt snapshot images. Ceph branches master, mimic, luminous and jewel are believed to be affected.","status":"published","published":"2022-05-13T01:34:56Z","modified":"2023-02-01T05:08:47Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:50:51.621418Z"}],"nvd":[{"id":"CVE-2018-10861","description":"A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph storage pools and corrupt snapshot images. Ceph branches master, mimic, luminous and jewel are believed to be affected.","status":"published","published":"2018-07-10T14:29:00.213Z","modified":"2026-06-17T01:34:47.157Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5.5,"vector":"AV:N/AC:L/Au:S/C:N/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-285","CWE-287"],"updated_at":"2026-11-02T14:04:32.929986Z"}],"osv":[{"id":"CVE-2018-10861","description":"A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph storage pools and corrupt snapshot images. Ceph branches master, mimic, luminous and jewel are believed to be affected.","status":"published","published":"2018-07-10T14:29:00.213Z","modified":"2026-10-20T10:49:58.563842408Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:07.641418Z"},{"id":"DEBIAN-CVE-2018-10861","description":"A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph storage pools and corrupt snapshot images. Ceph branches master, mimic, luminous and jewel are believed to be affected.","status":"published","published":"2018-07-10T14:29:00.213Z","modified":"2026-10-23T18:02:57.338239075Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:29.988046Z"},{"id":"RHSA-2018:2177","title":"Red Hat Security Advisory: Red Hat Ceph Storage 3.0 security and bug fix update","status":"published","published":"2024-09-13T16:51:36Z","modified":"2026-06-28T10:25:36Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"RHSA-2018:2261","title":"Red Hat Security Advisory: Red Hat Ceph Storage 2.5 security, enhancement, and bug fix update","status":"published","published":"2024-09-13T16:51:41Z","modified":"2026-06-28T10:25:47Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"UBUNTU-CVE-2018-10861","description":"A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph storage pools and corrupt snapshot images. Ceph branches master, mimic, luminous and jewel are believed to be affected.","status":"published","published":"2018-07-10T14:29:00Z","modified":"2026-04-22T11:40:35.499315Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:16.544091Z"},{"id":"DSA-4339-1","title":"ceph - security update","status":"published","published":"2018-11-13T00:00:00Z","modified":"2026-03-09T02:10:26.047373Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"openSUSE-SU-2019:1284-1","title":"Security update for ceph","description":"This update for ceph version 13.2.4 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-14662: Fixed an issue with LUKS 'config-key' safety (bsc#1111177)\n- CVE-2018-10861: Fixed an authorization bypass on OSD pool ops in ceph-mon (bsc#1099162)\n- CVE-2018-1128: Fixed signature check bypass in cephx (bsc#1096748)\n- CVE-2018-1129: Fixed replay attack in cephx protocol (bsc#1096748)\n- CVE-2018-16846: Enforced bounds on max-keys/max-uploads/max-parts in rgw (bsc#1114710)\n\nNon-security issues fixed:\n\n- ceph-volume Python 3 fixes (bsc#1114567)\n- Fixed python3 module loading (bsc#1086613)\n- Fixed an issue where ceph build fails (bsc#1084645)\n- ceph's SPDK builds with march=native (bsc#1101262)\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-04-27T15:48:20Z","modified":"2026-02-04T02:16:09.043473Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:10676-1","title":"ceph-16.2.6.45+g8fda9838398-1.1 on GA media","description":"These are all security issues fixed in the ceph-16.2.6.45+g8fda9838398-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:26:40.49272Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2018:1920-1","title":"Security update for ceph","description":"This update for ceph to version ceph-12.2.5-419-g8cbf63d997 fixes the following issues:\n\n- CVE-2018-10861: Ensure that ceph-mon does perform authorization on all OSD pool ops (bsc#1099162).\n- CVE-2018-1129: cephx signature check bypass (bsc#1096748).\n- CVE-2018-1128: cephx protocol was vulnerable to replay attack (bsc#1096748).\n","status":"published","published":"2018-07-10T07:42:02Z","modified":"2025-05-02T04:07:26.709925Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"SUSE-SU-2018:2193-1","title":"Security update for ceph","description":"This update for ceph fixes the following issues:\n\n- Update to version 12.2.7-420-gc0ef85b854:\n    * https://ceph.com/releases/12-2-7-luminous-released/\n    * luminous: osd: eternal stuck PG in 'unfound_recovery' (bsc#1094932)\n    * bluestore: db.slow used when db is not full (bsc#1092874)\n\n    * CVE-2018-10861: Ensure that ceph-mon does perform authorization on all OSD pool ops (bsc#1099162).\n    * CVE-2018-1129: cephx signature check bypass (bsc#1096748).\n    * CVE-2018-1128: cephx protocol was vulnerable to replay attack (bsc#1096748).\n\n  ","status":"published","published":"2018-08-03T17:46:09Z","modified":"2026-02-04T03:41:14.572144Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"SUSE-SU-2018:2299-1","title":"Security update for ceph","description":"This update for ceph fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-10861: Fix ceph-mon authorization on OSD pool ops (bsc#1099162).\n- CVE-2018-1128: Fix cephx signature check bypass (bsc#1096748).\n- CVE-2018-1129: Fix cephx protocol vulnerability to replay attack (bsc#1096748).\n- CVE-2018-7262: Fix malformed http headers that can crash rgw (bsc#1081379).\n\nBug fixes:\n\n- bsc#1072512: multipart uploads are broken if the bucket has been resharded\n- bsc#1080112: rgw: user stats increased after bucket reshard\n- bsc#1086340: SES5: XFS metadata corruption on rbd-nbd mapped image with journaling feature enabled\n","status":"published","published":"2018-08-10T09:36:47Z","modified":"2025-05-02T04:07:26.834793Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"SUSE-SU-2018:2478-1","title":"Security update for ceph","description":"This update for ceph fixes the following issues:\n\n- Update to version 12.2.7-420-gc0ef85b854:\n    * https://ceph.com/releases/12-2-7-luminous-released/\n    * luminous: osd: eternal stuck PG in 'unfound_recovery' (bsc#1094932)\n    * bluestore: db.slow used when db is not full (bsc#1092874)\n\n    * CVE-2018-10861: Ensure that ceph-mon does perform authorization on all OSD pool ops (bsc#1099162).\n    * CVE-2018-1129: cephx signature check bypass (bsc#1096748).\n    * CVE-2018-1128: cephx protocol was vulnerable to replay attack (bsc#1096748).\n\n  ","status":"published","published":"2018-08-03T17:46:09Z","modified":"2026-02-04T03:01:49.539387Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2019:0586-1","title":"Security update for ceph","description":"This update for ceph version 13.2.4 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-14662: Fixed an issue with LUKS 'config-key' safety (bsc#1111177)\n- CVE-2018-10861: Fixed an authorization bypass on OSD pool ops in ceph-mon (bsc#1099162)\n- CVE-2018-1128: Fixed signature check bypass in cephx (bsc#1096748)\n- CVE-2018-1129: Fixed replay attack in cephx protocol (bsc#1096748)\n- CVE-2018-16846: Enforced bounds on max-keys/max-uploads/max-parts in rgw\n\nNon-security issues fixed:\n\n- ceph-volume Python 3 fixes (bsc#1114567)\n- fix python3 module loading (bsc#1086613)\n","status":"published","published":"2019-03-12T12:00:39Z","modified":"2026-02-04T02:49:28.98909Z","updated_at":"2026-11-02T15:53:45.926331Z"}]}}