CVE-2021-20288
Summary
| CVE | CVE-2021-20288 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2021-04-15 15:15:00 UTC |
|---|
| Updated | 2023-11-07 03:29:00 UTC |
|---|
| Description | An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse. An attacker who can request a global_id can exploit the ability of any user to request a global_id previously associated with another user, as ceph does not force the reuse of old keys to generate new ones. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| 1938031 – (CVE-2021-20288) CVE-2021-20288 ceph: Unauthorized global_id reuse in cephx |
MISC |
bugzilla.redhat.com |
|
| [SECURITY] [DLA 3629-1] ceph security update |
MLIST |
lists.debian.org |
|
| [SECURITY] Fedora 34 Update: ceph-16.2.1-1.fc34 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| [SECURITY] Fedora 32 Update: ceph-14.2.20-1.fc32 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| [SECURITY] Fedora 34 Update: ceph-16.2.1-1.fc34 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| [SECURITY] Fedora 33 Update: ceph-15.2.11-1.fc33 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| [SECURITY] Fedora 33 Update: ceph-15.2.11-1.fc33 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| Ceph: Multiple vulnerabilities (GLSA 202105-39) — Gentoo security |
GENTOO |
security.gentoo.org |
|
| [SECURITY] Fedora 32 Update: ceph-14.2.20-1.fc32 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 174975 SUSE Enterprise Linux Security Update for ceph (SUSE-SU-2021:1473-1)
- 174976 SUSE Enterprise Linux Security Update for ceph (SUSE-SU-2021:1474-1)
- 180513 Debian Security Update for ceph (CVE-2021-20288)
- 198423 Ubuntu Security Notification for Ceph vulnerabilities (USN-4998-1)
- 198554 Ubuntu Security Notification for Ceph Vulnerabilities (USN-5128-1)
- 239428 Red Hat Update for Red Hat Ceph Storage 4.2 (RHSA-2021:2445)
- 281282 Fedora Security Update for ceph (FEDORA-2021-168fbed46f)
- 281287 Fedora Security Update for ceph (FEDORA-2021-e65b9fb52e)
- 281288 Fedora Security Update for ceph (FEDORA-2021-e29c1ee892)
- 500844 Alpine Linux Security Update for ceph
- 501810 Alpine Linux Security Update for ceph
- 502828 Alpine Linux Security Update for ceph16
- 6000278 Debian Security Update for ceph (DLA 3629-1)
- 710075 Gentoo Linux Ceph Multiple vulnerabilities (GLSA 202105-39)
- 750229 OpenSUSE Security Update for ceph (openSUSE-SU-2021:0672-1)
