Project

General

Profile

Bug #24836

auth: cephx authorizer subject to replay

Added by Sage Weil over 5 years ago. Updated 28 days ago.

Status:
Resolved
Priority:
Normal
Assignee:
-
Category:
-
Target version:
-
% Done:

0%

Source:
Tags:
Backport:
Regression:
No
Severity:
3 - minor
Reviewed:
Affected Versions:
ceph-qa-suite:
Component(RADOS):
Pull request ID:
Crash signature (v1):
Crash signature (v2):

Description

The cephx authorizer does not have any challenge or nonce, and thus (if sniffed) can be reused by another session.

Fixes are in place:
master: f80b848d3f830eb6dba50123e04385173fa4540b
mimic: 4cbd72f11ecda4c28d1bf47328a4f8672295870a
luminous: 5ead97120e07054d80623dada90a5cc764c28468
jewel: 26816cd80ae245d351d5ce34d8af434fbc798602

CVE-2018-1128

History

#1 Updated by Sage Weil over 5 years ago

  • Project changed from Ceph to RADOS

#2 Updated by Ken Dreyer 28 days ago

  • Description updated (diff)

Also available in: Atom PDF