Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2018-14649 Details

Description

It was found that ceph-isci-cli package as shipped by Red Hat Ceph Storage 2 and 3 is using python-werkzeug in debug shell mode. This is done by setting debug=True in file /usr/bin/rbd-target-api provided by ceph-isci-cli package. This allows unauthenticated attackers to access this debug shell and escalate privileges. Once an attacker has successfully connected to this debug shell they will be able to execute arbitrary commands remotely. These commands will run with the same privileges as of user executing the application which is using python-werkzeug with debug shell mode enabled. In - Red Hat Ceph Storage 2 and 3, ceph-isci-cli package runs python-werkzeug library with root level permissions.

Metrics

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://access.redhat.com/articles/3623521 CVEMitigationPatchVendor Advisory
https://access.redhat.com/errata/RHSA-2018:2837 CVEVendor Advisory
https://access.redhat.com/errata/RHSA-2018:2838 CVEVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14649 CVEIssue TrackingVendor Advisory
https://github.com/ceph/ceph-iscsi-cli/issues/120 CVEExploitThird Party Advisory

see all 14 references

Weakness Enumeration

CWE-IDCWE NameSource
CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')[email protected]
NVD-CWE-noinfoInsufficient Information to Classify Weakness[email protected]

Affected Products

ProductVersions
redhat enterprise linux desktop
7.0

CPE

  • cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.
redhat enterprise linux server
7.0

CPE

  • cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.
redhat enterprise linux workstation
7.0

CPE

  • cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.
redhat ceph storage
2.0
3.0

CPE

  • cpe:2.3:a:redhat:ceph_storage:2.0:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:ceph_storage:3.0:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.
redhat ceph-iscsi-cli
All versions

CPE

  • cpe:2.3:a:redhat:ceph-iscsi-cli:-:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

9 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2018-14649
NVD Published Date:
Oct 9, 2018
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]
CVE-2018-14649 Details - Not Deferred