REDHAT-BUG-1632078: Ceph ceph-iscsi-cli vulnerability

Published Sep 24, 2018

Updated

The ceph-iscsi-cli package starts the rbd-target-api service in debug mode by default, which enables the underlying python-werkzeug debug console. A remote unauthenticated user can use the debug console to execute abitrary commands.

Upstream Bug:

https://github.com/ceph/ceph-iscsi-cli/issues/120

Affected Software

1 affected component

ceph ceph-iscsi-cli

Event History

Sep 24, 2018

Data Sourced

via Red Hat·05:12 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-1632078?

REDHAT-BUG-1632078 is considered a high severity vulnerability due to the potential for remote unauthenticated command execution.

How do I fix REDHAT-BUG-1632078?

To fix REDHAT-BUG-1632078, you should disable the rbd-target-api service debug mode or update to a patched version of the ceph-iscsi-cli package.

What versions are affected by REDHAT-BUG-1632078?

The vulnerability REDHAT-BUG-1632078 impacts the ceph-iscsi-cli package, but specific affected versions are not listed.

Can a remote user exploit REDHAT-BUG-1632078?

Yes, a remote unauthenticated user can exploit REDHAT-BUG-1632078 to execute arbitrary commands through the debug console.

Is authentication required to exploit REDHAT-BUG-1632078?

No, authentication is not required for a remote user to exploit REDHAT-BUG-1632078.