Red Hat Ceph Storage Osd vulnerabilities

5 CVEs affecting Red Hat Ceph Storage Osd, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2016-9579, published 2018-08-01.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-9579, published 2018-08-01. High severity, CVSS 7.5. EPSS: 4.3% chance of exploitation in the next 30 days. A flaw was found in the way Ceph Object Gateway would process cross-origin HTTP requests if the CORS policy was set to allow origin on a bucket. A remote unauthenticated attacker could use this flaw…
CVE-2018-10861, published 2018-07-10. High severity, CVSS 8.1. EPSS: 3.2% chance of exploitation in the next 30 days. A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph storage pools and corrupt snapshot images. Ceph branches…
CVE-2016-5009, published 2016-07-12. Medium severity, CVSS 6.5. EPSS: 2.5% chance of exploitation in the next 30 days. The handle_command function in mon/Monitor.cc in Ceph allows remote authenticated users to cause a denial of service (segmentation fault and ceph monitor crash) via an (1) empty or (2) crafted prefix.
CVE-2018-1129, published 2018-07-10. Medium severity, CVSS 6.5. EPSS: 1.9% chance of exploitation in the next 30 days. A flaw was found in the way signature calculation was handled by cephx authentication protocol. An attacker having access to ceph cluster network who is able to alter the message payload was able to…
CVE-2018-1128, published 2018-07-10. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to ceph cluster network who is able to sniff…