Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
t/package-announce%40lists.fedoraproject.org/message/QMTTB54QNTPD2SK6UL32EVQHMZP6BUUD/ - http://www.securitytracker.com/id/1040912 - https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0 - https://access.redhat.com/errata/RHSA-2018:1454 - https://access.redhat.com/errata/RHSA-2018:1455 - https://access.redhat.com/errata/RHSA-2018:1457 - https://access.redhat.com/errata/RHSA-2018:1459 - https://access.redhat.com/errata/RHSA-2018:1453 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CDCLLCHYFFXW354HMB5QBXOQOY5BH2EJ/ - https://access.redhat.com/errata/RHSA-2018:1524 - https://access.redha
t.org/message/CDCLLCHYFFXW354HMB5QBXOQOY5BH2EJ/ - https://access.redhat.com/errata/RHSA-2018:1524 - https://access.redhat.com/errata/RHSA-2018:1456 - https://access.redhat.com/errata/RHSA-2018:1461 - https://www.exploit-db.com/exploits/44652/ - https://www.exploit-db.com/exploits/44890/ - https://access.redhat.com/errata/RHSA-2018:1458 - https://access.redhat.com/errata/RHSA-2018:1460
CVE ID: CVE-2018-1112 State: PUBLISHED Published: 2018-04-25T12:00:00 Last Updated: 2024-08-05T03:51:48.898Z Severity: HIGH (CVSS 8 CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: unspecified Products: glusterfs Problem Types: CWE-287 Description: glusterfs server before versions 3.10.12, 4.0.2 is vulnerable when using 'auth.allow' option which allows any unauthenticated gluster client to connect from any network to mount gluster storage volumes. NOTE: this vulnerability exists because of a CVE-2018-1088 regression. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1112 - https://review.gluster.org/#/c/19899/1..2 - ht
References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1112 - https://review.gluster.org/#/c/19899/1..2 - https://access.redhat.com/articles/3422521 - https://access.redhat.com/errata/RHSA-2018:1268 - https://access.redhat.com/errata/RHSA-2018:1269 - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00035.html
CVE ID: CVE-2018-1113 State: PUBLISHED Published: 2018-07-02T18:00:00 Last Updated: 2024-08-05T03:51:48.931Z Severity: MEDIUM (CVSS 4.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: [UNKNOWN] Products: setup Problem Types: CWE-285 Description: setup before version 2.11.4-1.fc28 in Fedora and Red Hat Enterprise Linux added /sbin/nologin and /usr/sbin/nologin to /etc/shells. This violates security assumptions made by pam_shells and some daemons which allow access based on a user's shell being listed in /etc/shells. Under some circumstances, users which had their shell changed to /sbin/nologin could still access the system. Additional Analyst Notes: - CVE Program Container: References:
l changed to /sbin/nologin could still access the system. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:3249 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1113 - https://access.redhat.com/errata/RHBA-2019:0327
CVE ID: CVE-2018-1114 State: PUBLISHED Published: 2018-09-11T15:00:00 Last Updated: 2024-08-05T03:51:48.638Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: undertow Problem Types: CWE-400 Description: It was found that URLResource.getLastModified() in Undertow closes the file descriptors only when they are finalized which can cause file descriptors to exhaust. This leads to a file handler leak. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1114 - https://access.redhat.com/errata/RHSA-2018:2669 - https://access.redhat.com/errata/RHSA-2018:2643 - https://issues.jboss.org
s://access.redhat.com/errata/RHSA-2018:2669 - https://access.redhat.com/errata/RHSA-2018:2643 - https://issues.jboss.org/browse/UNDERTOW-1338 - https://bugs.openjdk.java.net/browse/JDK-6956385 - https://access.redhat.com/errata/RHSA-2019:0877
CVE ID: CVE-2018-1115 State: PUBLISHED Published: 2018-05-10T19:00:00 Last Updated: 2024-08-05T03:51:48.772Z Severity: MEDIUM (CVSS 4.2 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: unspecified Products: postgresql Problem Types: CWE-732 Description: postgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension, the pg_catalog.pg_logfile_rotate() function doesn't follow the same ACLs than pg_rorate_logfile. If the adminpack is added to a database, an attacker able to connect to it could exploit this to force log rotation. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201810-08 - https://access.redhat.com/errata/RH
- CVE Program Container: References: - https://security.gentoo.org/glsa/201810-08 - https://access.redhat.com/errata/RHSA-2018:2566 - https://access.redhat.com/errata/RHSA-2018:2565 - http://www.securityfocus.com/bid/104285 - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1115 - https://git.postgresql.org/gitweb/?p=postgresql.git%3Ba=commitdiff%3Bh=7b34740
CVE ID: CVE-2018-1116 State: PUBLISHED Published: 2018-07-10T19:00:00 Last Updated: 2024-08-05T03:51:48.873Z Severity: MEDIUM (CVSS 4.7 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: [UNKNOWN] Products: polkit Problem Types: CWE-285 Description: A flaw was found in polkit before version 0.116. The implementation of the polkit_backend_interactive_authority_check_authorization function in polkitd allows to test for authentication and trigger authentication of unrelated processes owned by other users. This may result in a local DoS and information disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1116 - http
l Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1116 - https://usn.ubuntu.com/3717-2/ - https://cgit.freedesktop.org/polkit/commit/?id=bc7ffad5364 - https://lists.debian.org/debian-lts-announce/2018/07/msg00042.html - https://security.gentoo.org/glsa/201908-14
CVE ID: CVE-2018-1117 State: PUBLISHED Published: 2018-06-19T13:00:00 Last Updated: 2024-08-05T03:51:48.428Z Severity: MEDIUM (CVSS 5 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: [UNKNOWN] Products: ovirt-ansible-roles Problem Types: CWE-532 Description: ovirt-ansible-roles before version 1.0.6 has a vulnerability due to a missing no_log directive, resulting in the 'Add oVirt Provider to ManageIQ/CloudForms' playbook inadvertently disclosing admin passwords in the provisioning log. In an environment where logs are shared with other parties, this could lead to privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.
ilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1117 - http://www.securityfocus.com/bid/104186 - https://access.redhat.com/errata/RHSA-2018:1452
CVE ID: CVE-2018-1118 State: PUBLISHED Published: 2018-05-10T22:00:00 Last Updated: 2024-08-05T03:51:48.923Z Severity: LOW (CVSS 2.3 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: kernel Products: vhost Problem Types: CWE-665 Description: Linux kernel vhost since version 4.8 does not properly initialize memory in messages passed between virtual guests and the host operating system in the vhost/vhost.c:vhost_new_msg() function. This can allow local privileged users to read some kernel memory contents when reading from the /dev/vhost-net device file. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:3083 - https://usn.ubuntu.com
t Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:3083 - https://usn.ubuntu.com/3762-1/ - https://lists.debian.org/debian-lts-announce/2018/07/msg00020.html - https://access.redhat.com/errata/RHSA-2018:2948 - https://usn.ubuntu.com/3762-2/ - https://access.redhat.com/errata/RHSA-2018:3096 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1118
CVE ID: CVE-2018-1119 State: REJECTED Published: 2018-05-09T07:00:00 Last Updated: 2018-05-09T06:57:01 Description: No description available.
CVE ID: CVE-2018-1120 State: PUBLISHED Published: 2018-06-20T13:00:00 Last Updated: 2024-08-05T03:51:48.863Z Severity: LOW (CVSS 2.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) Vendors: [UNKNOWN] Products: kernel Problem Types: CWE-122 Description: A flaw was found affecting the Linux kernel before version 4.17. By mmap()ing a FUSE-backed file onto a process's memory containing command line arguments (or environment strings), an attacker can cause utilities from psutils or procps (such as ps, w) or any other program which makes a read() call to the /proc/<pid>/cmdline (or /proc/<pid>/environ) files to block indefinitely (denial of service) or for some controlled time (as a synchronization
/proc/<pid>/environ) files to block indefinitely (denial of service) or for some controlled time (as a synchronization primitive for other attacks). Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3752-2/ - https://access.redhat.com/errata/RHSA-2018:3083 - http://www.securityfocus.com/bid/104229 - https://usn.ubuntu.com/3752-3/ - https://security.gentoo.org/glsa/201805-14 - https://www.exploit-db.com/exploits/44806/ - https://usn.ubuntu.com/3910-1/ - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7f7ccc2ccc2e70c6054685f5e3522efa81556830 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1120 - https://usn.ubuntu.com/
2ccc2e70c6054685f5e3522efa81556830 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1120 - https://usn.ubuntu.com/3910-2/ - https://lists.debian.org/debian-lts-announce/2018/07/msg00020.html - https://access.redhat.com/errata/RHSA-2018:2948 - http://seclists.org/oss-sec/2018/q2/122 - https://usn.ubuntu.com/3752-1/ - https://access.redhat.com/errata/RHSA-2018:3096
CVE ID: CVE-2018-1121 State: PUBLISHED Published: 2018-06-13T20:00:00 Last Updated: 2024-08-05T03:51:48.742Z Severity: LOW (CVSS 3.9 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L) Vendors: [UNKNOWN] Products: procps-ng, procps Problem Types: CWE-367 Description: procps-ng, procps is vulnerable to a process hiding through race condition. Since the kernel's proc_pid_readdir() returns PID entries in ascending numeric order, a process occupying a high PID can use inotify events to determine when the process list is being scanned, and fork/exec to obtain a lower PID, thus avoiding enumeration. An unprivileged attacker can hide a process from procps-ng's utilities by exploiting a race condition in
g enumeration. An unprivileged attacker can hide a process from procps-ng's utilities by exploiting a race condition in reading /proc/PID entries. This vulnerability affects procps and procps-ng up to version 3.3.15, newer versions might be affected also. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44806/ - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1121 - http://www.securityfocus.com/bid/104214 - http://seclists.org/oss-sec/2018/q2/122 - https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt
CVE ID: CVE-2018-1122 State: PUBLISHED Published: 2018-05-23T14:00:00 Last Updated: 2024-08-05T03:51:48.790Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: [UNKNOWN] Products: procps-ng, procps Problem Types: CWE-829 Description: procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top. If a user runs top with HOME unset in an attacker-controlled directory, the attacker could achieve privilege escalation by exploiting one of several vulnerabilities in the config_file() function. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3658-1/ - https://www.debian.org/security/2018/dsa-4208 - https://s
gram Container: References: - https://usn.ubuntu.com/3658-1/ - https://www.debian.org/security/2018/dsa-4208 - https://security.gentoo.org/glsa/201805-14 - https://www.exploit-db.com/exploits/44806/ - https://lists.debian.org/debian-lts-announce/2018/05/msg00021.html - https://usn.ubuntu.com/3658-3/ - http://www.securityfocus.com/bid/104214 - http://seclists.org/oss-sec/2018/q2/122 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1122 - https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt - https://access.redhat.com/errata/RHSA-2019:2189 - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html - http://lists.opensuse.org/opensuse-security-announce/2
s.opensuse.org/opensuse-security-announce/2019-10/msg00058.html - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html - https://access.redhat.com/errata/RHSA-2020:0595
CVE ID: CVE-2018-1123 State: PUBLISHED Published: 2018-05-23T14:00:00 Last Updated: 2024-08-05T03:51:48.635Z Severity: LOW (CVSS 3.9 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L) Vendors: [UNKNOWN] Products: procps-ng, procps Problem Types: CWE-122 Description: procps-ng before version 3.3.15 is vulnerable to a denial of service in ps via mmap buffer overflow. Inbuilt protection in ps maps a guard page at the end of the overflowed buffer, ensuring that the impact of this flaw is limited to a crash (temporary denial of service). Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3658-1/ - https://www.debian.org/security/2018/dsa-4208 - https://security.gen
ner: References: - https://usn.ubuntu.com/3658-1/ - https://www.debian.org/security/2018/dsa-4208 - https://security.gentoo.org/glsa/201805-14 - https://www.exploit-db.com/exploits/44806/ - https://lists.debian.org/debian-lts-announce/2018/05/msg00021.html - https://usn.ubuntu.com/3658-3/ - http://www.securityfocus.com/bid/104214 - http://seclists.org/oss-sec/2018/q2/122 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1123 - https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html - https://lists.apache.org/thread.html/r
ml - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html - https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
CVE ID: CVE-2018-1124 State: PUBLISHED Published: 2018-05-23T13:00:00 Last Updated: 2024-08-05T03:51:48.632Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: [UNKNOWN] Products: procps-ng Problem Types: CWE-190, CWE-122 Description: procps-ng before version 3.3.15 is vulnerable to multiple integer overflows leading to a heap corruption in file2strvec function. This allows a privilege escalation for a local attacker who can create entries in procfs by starting processes, which could result in crashes or arbitrary code execution in proc utilities run by other users. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3658-1/ -
s run by other users. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3658-1/ - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1124 - https://www.debian.org/security/2018/dsa-4208 - https://security.gentoo.org/glsa/201805-14 - https://www.exploit-db.com/exploits/44806/ - https://access.redhat.com/errata/RHSA-2018:1777 - https://kc.mcafee.com/corporate/index?page=content&id=SB10241 - https://lists.debian.org/debian-lts-announce/2018/05/msg00021.html - https://access.redhat.com/errata/RHSA-2018:2267 - https://access.redhat.com/errata/RHSA-2018:2268 - https://access.redhat.com/errata/RHSA-2018:1700 - https://help.ecostruxureit.com/display/public/UAD
ata/RHSA-2018:2268 - https://access.redhat.com/errata/RHSA-2018:1700 - https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0 - http://www.securityfocus.com/bid/104214 - http://seclists.org/oss-sec/2018/q2/122 - http://www.securitytracker.com/id/1041057 - https://access.redhat.com/errata/RHSA-2018:1820 - https://usn.ubuntu.com/3658-2/ - https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt - https://access.redhat.com/errata/RHSA-2019:1944 - https://access.redhat.com/errata/RHSA-2019:2401 - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html - http://lists.opensuse.org/opensuse-security-announce/20
.opensuse.org/opensuse-security-announce/2019-10/msg00058.html - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html
CVE ID: CVE-2018-1125 State: PUBLISHED Published: 2018-05-23T14:00:00 Last Updated: 2024-08-05T03:51:48.542Z Severity: MEDIUM (CVSS 4.4 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: [UNKNOWN] Products: procps-ng, procps Problem Types: CWE-121 Description: procps-ng before version 3.3.15 is vulnerable to a stack buffer overflow in pgrep. This vulnerability is mitigated by FORTIFY, as it involves strncat() to a stack-allocated string. When pgrep is compiled with FORTIFY (as on Red Hat Enterprise Linux and Fedora), the impact is limited to a crash. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1125 - https://usn.ub
Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1125 - https://usn.ubuntu.com/3658-1/ - https://www.debian.org/security/2018/dsa-4208 - https://lists.debian.org/debian-lts-announce/2018/05/msg00021.html - https://usn.ubuntu.com/3658-3/ - http://www.securityfocus.com/bid/104214 - http://seclists.org/oss-sec/2018/q2/122 - https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html
CVE ID: CVE-2018-1126 State: PUBLISHED Published: 2018-05-23T13:00:00 Last Updated: 2024-08-05T03:51:48.860Z Severity: MEDIUM (CVSS 4.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: [UNKNOWN] Products: procps-ng, procps Problem Types: CWE-190 Description: procps-ng before version 3.3.15 is vulnerable to an incorrect integer size in proc/alloc.* leading to truncation/integer overflow issues. This flaw is related to CVE-2018-1124. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3658-1/ - https://www.debian.org/security/2018/dsa-4208 - https://access.redhat.com/errata/RHSA-2018:1777 - https://lists.debian.org/debian-lts-announce/2018/05/msg00021.
-4208 - https://access.redhat.com/errata/RHSA-2018:1777 - https://lists.debian.org/debian-lts-announce/2018/05/msg00021.html - https://access.redhat.com/errata/RHSA-2018:2267 - https://access.redhat.com/errata/RHSA-2018:2268 - https://access.redhat.com/errata/RHSA-2018:1700 - https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0 - http://www.securityfocus.com/bid/104214 - http://seclists.org/oss-sec/2018/q2/122 - http://www.securitytracker.com/id/1041057 - https://access.redhat.com/errata/RHSA-2018:1820 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1126 - https://usn.ubuntu.com/3658-2/ - https://www.qualys.com/2018/05/17/proc
zilla.redhat.com/show_bug.cgi?id=CVE-2018-1126 - https://usn.ubuntu.com/3658-2/ - https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt - https://access.redhat.com/errata/RHSA-2019:1944 - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html
CVE ID: CVE-2018-1127 State: PUBLISHED Published: 2018-09-11T15:00:00 Last Updated: 2024-08-05T03:51:48.782Z Severity: MEDIUM (CVSS 4.2 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Red Hat Products: Red Hat Gluster Storage Problem Types: CWE-613 Description: Tendrl API in Red Hat Gluster Storage before 3.4.0 does not immediately remove session tokens after a user logs out. Session tokens remain active for a few minutes allowing attackers to replay tokens acquired via sniffing/MITM attacks and authenticate as the target user. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:2616 - http://www.securitytracker.com/id/1041597 -
Container: References: - https://access.redhat.com/errata/RHSA-2018:2616 - http://www.securitytracker.com/id/1041597 - https://github.com/Tendrl/api/pull/422 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1127
CVE ID: CVE-2018-1128 State: PUBLISHED Published: 2018-07-10T14:00:00Z Last Updated: 2024-09-16T20:27:12.357Z Vendors: Red Hat, Inc. Products: ceph Problem Types: CWE-294 Description: It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to ceph cluster network who is able to sniff packets on network can use this vulnerability to authenticate with ceph service and perform actions allowed by ceph service. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:2261 - ht
e. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:2261 - https://access.redhat.com/errata/RHSA-2018:2177 - https://github.com/ceph/ceph/commit/5ead97120e07054d80623dada90a5cc764c28468 - https://access.redhat.com/errata/RHSA-2018:2179 - https://access.redhat.com/errata/RHSA-2018:2274 - https://www.debian.org/security/2018/dsa-4339 - https://lists.debian.org/debian-lts-announce/2019/03/msg00017.html - http://tracker.ceph.com/issues/24836 - https://bugzilla.redhat.com/show_bug.cgi?id=1575866 - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00100.html - http://www.openwall.com/lists/oss-security/2020/11/17/3 - http://w
rg/opensuse-security-announce/2019-04/msg00100.html - http://www.openwall.com/lists/oss-security/2020/11/17/3 - http://www.openwall.com/lists/oss-security/2020/11/17/4
CVE ID: CVE-2018-1129 State: PUBLISHED Published: 2018-07-10T14:00:00Z Last Updated: 2024-09-17T01:45:51.875Z Vendors: Red Hat, Inc. Products: ceph Problem Types: CWE-284 Description: A flaw was found in the way signature calculation was handled by cephx authentication protocol. An attacker having access to ceph cluster network who is able to alter the message payload was able to bypass signature checks done by cephx protocol. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:2261 - https://access.redhat.com/errata/RHSA-2018:2177 - https://bugzilla.redhat.c
://access.redhat.com/errata/RHSA-2018:2261 - https://access.redhat.com/errata/RHSA-2018:2177 - https://bugzilla.redhat.com/show_bug.cgi?id=1576057 - https://access.redhat.com/errata/RHSA-2018:2179 - https://access.redhat.com/errata/RHSA-2018:2274 - http://tracker.ceph.com/issues/24837 - https://github.com/ceph/ceph/commit/8f396cf35a3826044b089141667a196454c0a587 - https://www.debian.org/security/2018/dsa-4339 - https://lists.debian.org/debian-lts-announce/2019/03/msg00017.html - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00100.html - http://packetstormsecurity.com/files/154245/Kernel-Live-Patch-Security-Notice-LSN-0054-1.html