Back
CVE-2018-12088
S3QL before 2.27 mishandles checksumming, and consequently allows replay attacks in which an attacker who controls the backend can present…
High7.5EPSS 1.9%
- Published
- Updated
- Reserved
- Assigned by
- mitre
Description
S3QL before 2.27 mishandles checksumming, and consequently allows replay attacks in which an attacker who controls the backend can present old versions of the filesystem metadata database as up-to-date, temporarily inject zero-valued bytes into files, or temporarily hide parts of files. This is related to the checksum_basic_mapping function.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.0 | High7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
- EPSS (exploitation in 30 days)
- 1.9% · top 21% of all CVEs (5 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.
Weakness
Affected products
n/a
- affected n/a
References (3)
- https://bitbucket.org/nikratio/s3ql/issues/272/t3_verifypy-test_retrieve-sometimes-fails (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://groups.google.com/forum/#%21topic/s3ql/4TzCVIMkA4o (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://bitbucket.org/nikratio/s3ql/commits/85aba5c2d5c81453a73a50ed638adaeef0521020 (opens in a new tab)x_refsource_CONFIRMx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2018-12088)Record last updated .