Ceph
By the Year
In 2024 there have been 0 vulnerabilities in Ceph . Ceph did not have any published security vulnerabilities last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2024 | 0 | 0.00 |
| 2023 | 0 | 0.00 |
| 2022 | 1 | 9.10 |
| 2021 | 0 | 0.00 |
| 2020 | 1 | 6.50 |
| 2019 | 1 | 7.50 |
| 2018 | 2 | 7.30 |
It may take a day or so for new Ceph vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Ceph Security Vulnerabilities
A flaw was found in Openstack manilla owning a Ceph File system "share"
CVE-2022-0670
9.1 - Critical
- July 25, 2022
A flaw was found in Openstack manilla owning a Ceph File system "share", which enables the owner to read/write any manilla share or entire file system. The vulnerability is due to a bug in the "volumes" plugin in Ceph Manager. This allows an attacker to compromise Confidentiality and Integrity of a file system. Fixed in RHCS 5.2 and Ceph 17.2.2.
A flaw was found in the way the Ceph RGW Beast front-end handles unexpected disconnects
CVE-2020-1700
6.5 - Medium
- February 07, 2020
A flaw was found in the way the Ceph RGW Beast front-end handles unexpected disconnects. An authenticated attacker can abuse this flaw by making multiple disconnect attempts resulting in a permanent leak of a socket connection by radosgw. This flaw could lead to a denial of service condition by pile up of CLOSE_WAIT sockets, eventually leading to the exhaustion of available resources, preventing legitimate users from connecting to the system.
Resource Exhaustion
A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests
CVE-2019-10222
7.5 - High
- November 08, 2019
A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests. An unauthenticated attacker could crash the Ceph RGW server by sending valid HTTP headers and terminating the connection, resulting in a remote denial of service for Ceph RGW clients.
Improper Handling of Exceptional Conditions
A flaw was found in the way signature calculation was handled by cephx authentication protocol
CVE-2018-1129
6.5 - Medium
- July 10, 2018
A flaw was found in the way signature calculation was handled by cephx authentication protocol. An attacker having access to ceph cluster network who is able to alter the message payload was able to bypass signature checks done by cephx protocol. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable.
authentification
A flaw was found in the way ceph mon handles user requests
CVE-2018-10861
8.1 - High
- July 10, 2018
A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph storage pools and corrupt snapshot images. Ceph branches master, mimic, luminous and jewel are believed to be affected.
authentification
