CVE-2018-14649

It was found that ceph-isci-cli package as shipped by Red Hat Ceph Storage 2 and 3 is using python-werkzeug in debug shell mode. This is done by setting debug=True in file /usr/bin/rbd-target-api provided by ceph-isci-cli package. This allows unauthenticated attackers to access this debug shell and escalate privileges. Once an attacker has successfully connected to this debug shell they will be able to execute arbitrary commands remotely. These commands will run with the same privileges as of user executing the application which is using python-werkzeug with debug shell mode enabled. In - Red Hat Ceph Storage 2 and 3, ceph-isci-cli package runs python-werkzeug library with root level permissions.

• CWE-77

• http://www.securityfocus.com/bid/105434Third Party Advisory, VDB Entry
• https://access.redhat.com/articles/3623521Mitigation, Patch, Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2837Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2838Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14649Issue Tracking, Vendor Advisory
• https://github.com/ceph/ceph-iscsi-cli/issues/120Exploit, Third Party Advisory
• https://github.com/ceph/ceph-iscsi-cli/pull/121/commits/c3812075e30c76a800a961e7291087d357403f6bPatch, Vendor Advisory
• http://www.securityfocus.com/bid/105434Third Party Advisory, VDB Entry
• https://access.redhat.com/articles/3623521Mitigation, Patch, Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2837Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2838Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14649Issue Tracking, Vendor Advisory
• https://github.com/ceph/ceph-iscsi-cli/issues/120Exploit, Third Party Advisory
• https://github.com/ceph/ceph-iscsi-cli/pull/121/commits/c3812075e30c76a800a961e7291087d357403f6bPatch, Vendor Advisory

Published

Oct 9, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-14643An authentication bypass flaw was found in the smart_proxy_d…9.8
• CVE-2018-14644An issue has been found in PowerDNS Recursor from 4.0.0 up t…5.3
• CVE-2018-14645A flaw was discovered in the HPACK decoder of HAProxy, befor…7.5
• CVE-2018-14646The Linux kernel before 4.15-rc8 was found to be vulnerable …5.5
• CVE-2018-14647Python's elementtree C accelerator failed to initialise Expa…7.5
• CVE-2018-14648A flaw was found in 389 Directory Server. A specially crafte…7.5
• CVE-2018-1465IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtua…5.3
• CVE-2018-14650It was discovered that sos-collector does not properly set t…5.9
• CVE-2018-14651It was found that the fix for CVE-2018-10927, CVE-2018-10928…8.8
• CVE-2018-14652The Gluster file system through versions 3.12 and 4.1.4 is v…6.5
• CVE-2018-14653The Gluster file system through versions 4.1.4 and 3.12 is v…8.8
• CVE-2018-14654The Gluster file system through version 4.1.4 is vulnerable …6.5