Not rated
CVE-2021-20288 An authentication flaw was found in ceph in versions before 14.2.20
Description
An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse. An attacker who can request a global_id can exploit the ability of any user to request a global_id previously associated with another user, as ceph does not force the reuse of old keys to generate new ones. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| ceph | Versions not published |
References
- bugzilla.redhat.com bugzilla.redhat.com
- FEDORA-2021-e29c1ee892 lists.fedoraproject.org
- FEDORA-2021-e65b9fb52e lists.fedoraproject.org
- FEDORA-2021-168fbed46f lists.fedoraproject.org
- GLSA-202105-39 security.gentoo.org
- [debian-lts-announce] 20231023 [SECURITY] [DLA 3629-1] ceph security update lists.debian.org
Timeline
- Published
- Last modified
Other CVEs of ceph
The 10 CVEs of ceph →
CVE-2022-3854
A flaw was found in Ceph, relating to the URL processing on RGW backends
6.5
Medium
CVE-2022-3650
A privilege escalation flaw was found in Ceph
Not rated
CVE-2021-3979
A key length flaw was found in Red Hat Ceph Storage
Not rated
CVE-2022-0670
A flaw was found in Openstack manilla owning a Ceph File system "share", which enables the owner to read/write any…
Not rated