CVE-2021-20288
published 2021-04-15CVE-2021-20288: An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize…
PriorityP348high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EPSS
2.13%
79.9th percentile
An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse. An attacker who can request a global_id can exploit the ability of any user to request a global_id previously associated with another user, as ceph does not force the reuse of old keys to generate new ones. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | ceph | < ceph 14.2.20-1 (bookworm) | ceph 14.2.20-1 (bookworm) |
| debian | debian_linux | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| linuxfoundation | ceph | < 14.2.21 | 14.2.21 |
| linuxfoundation | ceph | — | — |
| linuxfoundation | ceph | >= 0 < 14.2.20-1 | 14.2.20-1 |
| linuxfoundation | ceph | >= 0 < 14.2.20-1 | 14.2.20-1 |
| linuxfoundation | ceph | >= 0 < 14.2.20-1 | 14.2.20-1 |
| linuxfoundation | ceph | >= 0 < 14.2.20-1 | 14.2.20-1 |
| redhat | ceph | >= 0 < 12.2.13-0ubuntu0.18.04.10 | 12.2.13-0ubuntu0.18.04.10 |
| redhat | ceph | >= 0 < 15.2.12-0ubuntu0.20.04.1 | 15.2.12-0ubuntu0.20.04.1 |
| redhat | ceph_storage | — | — |
CVSS provenance
nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
osv7.2HIGH
vendor_debian7.2HIGH
vendor_redhat7.2HIGH
vendor_ubuntu7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-39jx-6759-44c6: An authentication flaw was found in ceph in versions before 14
ghsa_unreviewed·2022-05-24
CVE-2021-20288 [HIGH] CWE-287 GHSA-39jx-6759-44c6: An authentication flaw was found in ceph in versions before 14
An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse. An attacker who can request a global_id can exploit the ability of any user to request a global_id previously associated with another user, as ceph does not force the reuse of old keys to generate new ones. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
OSV
ceph vulnerabilities
osv·2021-11-01·CVSS 7.1
CVE-2020-27781 [HIGH] ceph vulnerabilities
ceph vulnerabilities
Goutham Pacha Ravi, Jahson Babel, and John Garbutt discovered that user
credentials in Ceph could be manipulated in certain environments. An
attacker could use this to gain unintended access to resources. This issue
only affected Ubuntu 18.04 LTS. (CVE-2020-27781)
It was discovered that Ceph contained an authentication flaw, leading to
key reuse. An attacker could use this to cause a denial of service or
possibly impersonate another user. This issue only affected Ubuntu 21.04.
(CVE-2021-20288)
Sergey Bobrov discovered that the Ceph dashboard was susceptible to a
cross-site scripting attack. An attacker could use this to expose sensitive
information or gain unintended access. This issue only affected Ubuntu
21.04. (CVE-2021-3509)
Sergey Bobrov discovered that Ceph's
OSV
ceph vulnerabilities
osv·2021-06-25·CVSS 4.4
CVE-2020-25678 [MEDIUM] ceph vulnerabilities
ceph vulnerabilities
It was discovered that in some situations Ceph logged passwords from the
mgr module in clear text. An attacker could use this to expose sensitive
information. (CVE-2020-25678)
Goutham Pacha Ravi, Jahson Babel, and John Garbutt discovered that user
credentials in Ceph could be manipulated in certain environments. An
attacker could use this to gain unintended access. (CVE-2020-27781)
It was discovered that the Ceph dashboard was susceptible to a cross-site
scripting attack. An attacker could use this to expose sensitive
information or gain unintended access. (CVE-2020-27839)
It was discovered that Ceph contained an authentication flaw, leading to
key reuse. An attacker could use this to cause a denial of service or
possibly impersonate another user. (CVE-2021-20288)
OSV
CVE-2021-20288: An authentication flaw was found in ceph in versions before 14
osv·2021-04-15·CVSS 7.2
CVE-2021-20288 [HIGH] CVE-2021-20288: An authentication flaw was found in ceph in versions before 14
An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse. An attacker who can request a global_id can exploit the ability of any user to request a global_id previously associated with another user, as ceph does not force the reuse of old keys to generate new ones. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Kernel
libceph: bump CephXAuthenticate encoding version
kernel_security·2021-04-14·CVSS 7.2
CVE-2021-20288 [HIGH] libceph: bump CephXAuthenticate encoding version
libceph: bump CephXAuthenticate encoding version
A dummy v3 encoding (exactly the same as v2) was introduced so that
the monitors can distinguish broken clients that may not include their
auth ticket in CEPHX_GET_AUTH_SESSION_KEY request on reconnects, thus
failing to prove previous possession of their global_id (one part of
CVE-2021-20288).
The kernel client has always included its auth ticket, so it is
compatible with enforcing mode as is. However we want to bump the
encoding version to avoid having to authenticate twice on the initial
connect -- all legacy (CephXAuthenticate v3).
Cc: [email protected] # 5.11+
URL: https://tracker.ceph.com/issues/50452
Signed-off-by: Ilya Dryomov
Reviewed-by: Sage Weil
Ubuntu
Ceph vulnerabilities
vendor_ubuntu·2021-11-01·CVSS 7.1
CVE-2021-3531 [HIGH] Ceph vulnerabilities
Title: Ceph vulnerabilities
Summary: Several security issues were fixed in Ceph.
Goutham Pacha Ravi, Jahson Babel, and John Garbutt discovered that user
credentials in Ceph could be manipulated in certain environments. An
attacker could use this to gain unintended access to resources. This issue
only affected Ubuntu 18.04 LTS. (CVE-2020-27781)
It was discovered that Ceph contained an authentication flaw, leading to
key reuse. An attacker could use this to cause a denial of service or
possibly impersonate another user. This issue only affected Ubuntu 21.04.
(CVE-2021-20288)
Sergey Bobrov discovered that the Ceph dashboard was susceptible to a
cross-site scripting attack. An attacker could use this to expose sensitive
information or gain unintended access. This issue only affected Ubuntu
Ubuntu
Ceph vulnerabilities
vendor_ubuntu·2021-06-25·CVSS 4.4
CVE-2021-3509 [MEDIUM] Ceph vulnerabilities
Title: Ceph vulnerabilities
Summary: Several security issues were fixed in Ceph.
It was discovered that in some situations Ceph logged passwords from the
mgr module in clear text. An attacker could use this to expose sensitive
information. (CVE-2020-25678)
Goutham Pacha Ravi, Jahson Babel, and John Garbutt discovered that user
credentials in Ceph could be manipulated in certain environments. An
attacker could use this to gain unintended access. (CVE-2020-27781)
It was discovered that the Ceph dashboard was susceptible to a cross-site
scripting attack. An attacker could use this to expose sensitive
information or gain unintended access. (CVE-2020-27839)
It was discovered that Ceph contained an authentication flaw, leading to
key reuse. An attacker could use this to cause a denial of se
Red Hat
ceph: Unauthorized global_id reuse in cephx
vendor_redhat·2021-04-14·CVSS 7.2
CVE-2021-20288 [HIGH] CWE-287 ceph: Unauthorized global_id reuse in cephx
ceph: Unauthorized global_id reuse in cephx
An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse. An attacker who can request a global_id can exploit the ability of any user to request a global_id previously associated with another user, as ceph does not force the reuse of old keys to generate new ones. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
An authentication flaw was found in ceph. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse. An attacker who can request a global_id can exploit the ability of any user to request a glo
Debian
CVE-2021-20288: ceph - An authentication flaw was found in ceph in versions before 14.2.20. When the mo...
vendor_debian·2021·CVSS 7.2
CVE-2021-20288 [HIGH] CVE-2021-20288: ceph - An authentication flaw was found in ceph in versions before 14.2.20. When the mo...
An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse. An attacker who can request a global_id can exploit the ability of any user to request a global_id previously associated with another user, as ceph does not force the reuse of old keys to generate new ones. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Scope: local
bookworm: resolved (fixed in 14.2.20-1)
bullseye: resolved (fixed in 14.2.20-1)
forky: resolved (fixed in 14.2.20-1)
sid: resolved (fixed in 14.2.20-1)
trixie: resolved (fixed in 14.2.20-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://bugzilla.redhat.com/show_bug.cgi?id=1938031https://lists.debian.org/debian-lts-announce/2023/10/msg00034.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/362CEPPYF3YMJZBEJQUT3KDE2EHYYIYQ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5BPIAYTRCWAU4XWCDBK2THEFVXSC4XGK/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JVWUKUUS5BCIFWRV3JCUQMAPJ4HIWSED/https://security.gentoo.org/glsa/202105-39https://bugzilla.redhat.com/show_bug.cgi?id=1938031https://lists.debian.org/debian-lts-announce/2023/10/msg00034.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/362CEPPYF3YMJZBEJQUT3KDE2EHYYIYQ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5BPIAYTRCWAU4XWCDBK2THEFVXSC4XGK/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JVWUKUUS5BCIFWRV3JCUQMAPJ4HIWSED/https://security.gentoo.org/glsa/202105-39
2021-04-15
Published