What’s Vulnerable › Vulnerabilities

CVE-2018-10861

• Severity: high (CVSS 8.1 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-07-10 · updated 2026-06-17
• Weakness: CWE-285

Description

A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph storage pools and corrupt snapshot images. Ceph branches master, mimic, luminous and jewel are believed to be affected.

Affected products

• Ceph: 10.2.0, 10.2.1, 10.2.2, 10.2.3, 10.2.4, 10.2.5 (+16)
• Debian Linux: 9.0
• openSUSE Leap: 15.0
• Red Hat Ceph Storage: 3
• RedHat Ceph Storage Mon: 2, 3
• RedHat Ceph Storage Osd: 2, 3
• RedHat Enterprise Linux Desktop: 7.0
• RedHat Enterprise Linux Server: 7.0
• RedHat Enterprise Linux Workstation: 7.0

References

• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00100.html
• http://tracker.ceph.com/issues/24838
• http://www.securityfocus.com/bid/104742
• https://access.redhat.com/errata/RHSA-2018:2177
• https://access.redhat.com/errata/RHSA-2018:2179
• https://access.redhat.com/errata/RHSA-2018:2261
• https://access.redhat.com/errata/RHSA-2018:2274
• https://bugzilla.redhat.com/show_bug.cgi?id=1593308
• https://github.com/ceph/ceph/commit/975528f632f73fbffa3f1fee304e3bbe3296cffc
• https://www.debian.org/security/2018/dsa-4339
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00100.html
• http://tracker.ceph.com/issues/24838

Get alerted when CVE-2018-10861 or the next vulnerability affects your stack