Published: 15/04/2021 Updated: 16/02/2024

CVSS v2 Base Score: 6.5 | Impact Score: 6.4 | Exploitability Score: 8

CVSS v3 Base Score: 7.2 | Impact Score: 5.9 | Exploitability Score: 1.2

VMScore: 578

Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P

An authentication flaw was found in ceph in versions prior to 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse. An attacker who can request a global_id can exploit the ability of any user to request a global_id previously associated with another user, as ceph does not force the reuse of old keys to generate new ones. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Vulnerable Product	Search on Vulmon	Subscribe to Product
linuxfoundation ceph
redhat ceph storage 4.0
fedoraproject fedora 32
fedoraproject fedora 33
fedoraproject fedora 34
debian debian linux 10.0

Synopsis Important: Red Hat Ceph Storage 3 Security and Bug Fix update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update is now available for Red Hat Ceph Storage 3Red Hat Product Security has rated this update a ...

Debian Bug report logs - #986974 ceph: CVE-2021-20288 Package: src:ceph; Maintainer for src:ceph is Ceph Packaging Team <team+ceph@trackerdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Wed, 14 Apr 2021 19:33:02 UTC Severity: grave Tags: security, upstream Found in version ceph/14218-1 ...

An authentication flaw was found in ceph When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse An attacker who can request a global_id can exploit the ability of any user to request a global_id previously associated with another user, as ceph does not force the reuse of old keys to genera ...

CWE-287 https://bugzilla.redhat.com/show_bug.cgi?id=1938031 https://security.gentoo.org/glsa/202105-39 https://lists.debian.org/debian-lts-announce/2023/10/msg00034.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/362CEPPYF3YMJZBEJQUT3KDE2EHYYIYQ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5BPIAYTRCWAU4XWCDBK2THEFVXSC4XGK/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JVWUKUUS5BCIFWRV3JCUQMAPJ4HIWSED/https://access.redhat.com/errata/RHSA-2022:1394 https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2021-20288

CVE-2021-20288

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect