CVE - CVE-2018-14649

CVE-ID
CVE-2018-14649	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
It was found that ceph-isci-cli package as shipped by Red Hat Ceph Storage 2 and 3 is using python-werkzeug in debug shell mode. This is done by setting debug=True in file /usr/bin/rbd-target-api provided by ceph-isci-cli package. This allows unauthenticated attackers to access this debug shell and escalate privileges. Once an attacker has successfully connected to this debug shell they will be able to execute arbitrary commands remotely. These commands will run with the same privileges as of user executing the application which is using python-werkzeug with debug shell mode enabled. In - Red Hat Ceph Storage 2 and 3, ceph-isci-cli package runs python-werkzeug library with root level permissions.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:105434 URL:http://www.securityfocus.com/bid/105434 MISC:RHSA-2018:2837 URL:https://access.redhat.com/errata/RHSA-2018:2837 MISC:RHSA-2018:2838 URL:https://access.redhat.com/errata/RHSA-2018:2838 MISC:https://access.redhat.com/articles/3623521 URL:https://access.redhat.com/articles/3623521 MISC:https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14649 URL:https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14649 MISC:https://github.com/ceph/ceph-iscsi-cli/issues/120 URL:https://github.com/ceph/ceph-iscsi-cli/issues/120 MISC:https://github.com/ceph/ceph-iscsi-cli/pull/121/commits/c3812075e30c76a800a961e7291087d357403f6b URL:https://github.com/ceph/ceph-iscsi-cli/pull/121/commits/c3812075e30c76a800a961e7291087d357403f6b
Assigning CNA
Red Hat, Inc.
Date Record Created
20180727	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20180727)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)