CVE-2017-16818

RADOS Gateway in Ceph 12.1.0 through 12.2.1 allows remote authenticated users to cause a denial of service (assertion failure and application exit) by leveraging "full" (not necessarily admin) privileges to post an invalid profile to the admin API, related to rgw/rgw_iam_policy.cc, rgw/rgw_basic_types.h, and rgw/rgw_iam_types.h.

• CWE-617

• https://bugzilla.redhat.com/show_bug.cgi?id=1515872Issue Tracking, Patch, Third Party Advisory
• https://github.com/ceph/ceph/commit/b3118cabb8060a8cc6a01c4e8264cb18e7b1745aPatch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U6VJA32U7HKGDRJQDJVM7JBYWD4T7BJL/
• https://bugzilla.redhat.com/show_bug.cgi?id=1515872Issue Tracking, Patch, Third Party Advisory
• https://github.com/ceph/ceph/commit/b3118cabb8060a8cc6a01c4e8264cb18e7b1745aPatch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U6VJA32U7HKGDRJQDJVM7JBYWD4T7BJL/

Published

Dec 20, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-1681IBM WebSphere Application Server (IBM Liberty for Java for B…
• CVE-2017-16810Cross-site scripting (XSS) vulnerability in the All Variable…
• CVE-2017-16813A denial-of-service issue was discovered in the Foxit Mobile…
• CVE-2017-16814A Directory Traversal issue was discovered in the Foxit Mobi…
• CVE-2017-16815installer.php in the Snap Creek Duplicator (WordPress Site M…
• CVE-2017-16816The condor_schedd component in HTCondor before 8.6.8 and 8.7…
• CVE-2017-16819A stored cross-site scripting vulnerability in the Icon Time…
• CVE-2017-1682IBM Connections 4.0, 4.5, 5.0, 5.5, and 6.0 is vulnerable to…
• CVE-2017-16820The csnmp_read_table function in snmp.c in the SNMP plugin i…
• CVE-2017-16821b3log Symphony (aka Sym) 2.2.0 has XSS in processor/AdminPro…5.4
• CVE-2017-16826The coff_slurp_line_table function in coffcode.h in the Bina…
• CVE-2017-16827The aout_get_external_symbols function in aoutx.h in the Bin…