CVE-2018-1128

Name of the Vulnerable Software and Affected Versions Ceph branches master, mimic, luminous, and jewel are believed to be vulnerable.

Description The cephx authentication protocol did not correctly verify Ceph clients, making it vulnerable to a replay attack. An attacker with access to the Ceph cluster network who can sniff packets can use this issue to authenticate with the Ceph service and perform actions allowed by the service.

Recommendations For Ceph branches master, mimic, luminous, and jewel, consider restricting access to the Ceph cluster network to minimize the risk of exploitation until a fix is available. As a temporary workaround, review and enhance the authentication mechanisms to prevent replay attacks. Restrict actions allowed by the Ceph service to minimize potential damage from unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.