Log in Start free

Vulnerability · Published Apr 15, 2021 · Assigned by redhat

CVE-2021-20288

High 7.2

In plain English

A high-severity improper authentication in ceph. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.2High
Exploit odds (30 days)2.1%top 18.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse. An attacker who can request a global_id can exploit the ability of any user to request a global_id previously associated with another user, as ceph does not force the reuse of old keys to generate new ones. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12ceph14.2.20-1DEBIAN-CVE-2021-20288
Debian:13ceph14.2.20-1DEBIAN-CVE-2021-20288
Debian:14ceph14.2.20-1DEBIAN-CVE-2021-20288

Affected products (as reported)

VendorProductVersions
n/a ceph ceph 14.2.20

Weakness: CWE-287

References