Red Hat CEPH-ISCSI-CLI

CPE Details

Red Hat CEPH-ISCSI-CLI
redhat
ceph-iscsi-cli
-
2019-06-17
10h49 +00:00
2019-06-17
10h49 +00:00
CPE NVD
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:a:redhat:ceph-iscsi-cli:-:*:*:*:*:*:*:*

Informations

Vendor

redhat

Product

ceph-iscsi-cli

Version

-

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2018-14649 2018-10-09 15h00 +00:00 It was found that ceph-isci-cli package as shipped by Red Hat Ceph Storage 2 and 3 is using python-werkzeug in debug shell mode. This is done by setting debug=True in file /usr/bin/rbd-target-api provided by ceph-isci-cli package. This allows unauthenticated attackers to access this debug shell and escalate privileges. Once an attacker has successfully connected to this debug shell they will be able to execute arbitrary commands remotely. These commands will run with the same privileges as of user executing the application which is using python-werkzeug with debug shell mode enabled. In - Red Hat Ceph Storage 2 and 3, ceph-isci-cli package runs python-werkzeug library with root level permissions.
9.8
Critical