CVE-2021-20288: High severity ceph vulnerability
An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHXGETAUTHSESSIONKEY requests, it doesn't sanitize otherkeys, allowing key reuse. An attacker who can request a globalid can exploit the ability of any user to request a globalid previously associated with another user, as ceph does not force the reuse of old keys to generate new ones. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Other sources
The reuse of old keys to generate new ones, in conjunction with the ability for a user to request any global id, presents an opportunity for an attacker to request a previously valid global id without the corresponding prior key.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-20288?
CVE-2021-20288 is an authentication flaw found in ceph before version 14.2.20.
What is the severity of CVE-2021-20288?
The severity of CVE-2021-20288 is high with a CVSS score of 7.2.
How does CVE-2021-20288 impact Linuxfoundation Ceph?
CVE-2021-20288 affects Linuxfoundation Ceph versions before 14.2.20.
How does CVE-2021-20288 impact Red Hat Ceph Storage?
CVE-2021-20288 affects Red Hat Ceph Storage version 4.0.
How can I fix CVE-2021-20288?
To fix CVE-2021-20288, update ceph to version 14.2.20 or newer.