CVE-2021-20288
ceph: An authentication flaw was found in ceph in versions before 14.2.20
CVE-2021-20288 is fixed in 37 products on 1 platform, first by ceph 15.2.12-0ubuntu0.20.04.1, released May 26, 2021. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
n/a
Medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0211
81st percentile
An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse. An attacker who can request a global_id can exploit the ability of any user to request a global_id previously associated with another user, as ceph does not force the reuse of old keys to generate new ones. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| ceph · Ubuntu 20.04 LTS (focal) | 15.2.12-0ubuntu0.20.04.1 | ceph 15.2.12-0ubuntu0.20.04.1 | May 26, 2021 |
| ceph-base · Ubuntu 20.04 LTS (focal) | 15.2.12-0ubuntu0.20.04.1 | ceph-base 15.2.12-0ubuntu0.20.04.1 | May 26, 2021 |
| ceph-common · Ubuntu 20.04 LTS (focal) | 15.2.12-0ubuntu0.20.04.1 | ceph-common 15.2.12-0ubuntu0.20.04.1 | May 26, 2021 |
| ceph-fuse · Ubuntu 20.04 LTS (focal) | 15.2.12-0ubuntu0.20.04.1 | ceph-fuse 15.2.12-0ubuntu0.20.04.1 | May 26, 2021 |
| ceph-immutable-object-cache · Ubuntu 20.04 LTS (focal) | 15.2.12-0ubuntu0.20.04.1 | ceph-immutable-object-cache 15.2.12-0ubuntu0.20.04.1 | May 26, 2021 |
| ceph-mds · Ubuntu 20.04 LTS (focal) | 15.2.12-0ubuntu0.20.04.1 | ceph-mds 15.2.12-0ubuntu0.20.04.1 | May 26, 2021 |
| ceph-mgr · Ubuntu 20.04 LTS (focal) | 15.2.12-0ubuntu0.20.04.1 | ceph-mgr 15.2.12-0ubuntu0.20.04.1 | May 26, 2021 |
| ceph-mgr-cephadm · Ubuntu 20.04 LTS (focal) | 15.2.12-0ubuntu0.20.04.1 | ceph-mgr-cephadm 15.2.12-0ubuntu0.20.04.1 | May 26, 2021 |
| ceph-mgr-dashboard · Ubuntu 20.04 LTS (focal) | 15.2.12-0ubuntu0.20.04.1 | ceph-mgr-dashboard 15.2.12-0ubuntu0.20.04.1 | May 26, 2021 |
| ceph-mgr-diskprediction-cloud · Ubuntu 20.04 LTS (focal) | 15.2.12-0ubuntu0.20.04.1 | ceph-mgr-diskprediction-cloud 15.2.12-0ubuntu0.20.04.1 | May 26, 2021 |
| ceph-mgr-diskprediction-local · Ubuntu 20.04 LTS (focal) | 15.2.12-0ubuntu0.20.04.1 | ceph-mgr-diskprediction-local 15.2.12-0ubuntu0.20.04.1 | May 26, 2021 |
| ceph-mgr-k8sevents · Ubuntu 20.04 LTS (focal) | 15.2.12-0ubuntu0.20.04.1 | ceph-mgr-k8sevents 15.2.12-0ubuntu0.20.04.1 | May 26, 2021 |
| ceph-mgr-modules-core · Ubuntu 20.04 LTS (focal) | 15.2.12-0ubuntu0.20.04.1 | ceph-mgr-modules-core 15.2.12-0ubuntu0.20.04.1 | May 26, 2021 |
| ceph-mgr-rook · Ubuntu 20.04 LTS (focal) | 15.2.12-0ubuntu0.20.04.1 | ceph-mgr-rook 15.2.12-0ubuntu0.20.04.1 | May 26, 2021 |
| ceph-mon · Ubuntu 20.04 LTS (focal) | 15.2.12-0ubuntu0.20.04.1 | ceph-mon 15.2.12-0ubuntu0.20.04.1 | May 26, 2021 |
| ceph-osd · Ubuntu 20.04 LTS (focal) | 15.2.12-0ubuntu0.20.04.1 | ceph-osd 15.2.12-0ubuntu0.20.04.1 | May 26, 2021 |
| ceph-resource-agents · Ubuntu 20.04 LTS (focal) | 15.2.12-0ubuntu0.20.04.1 | ceph-resource-agents 15.2.12-0ubuntu0.20.04.1 | May 26, 2021 |
| cephadm · Ubuntu 20.04 LTS (focal) | 15.2.12-0ubuntu0.20.04.1 | cephadm 15.2.12-0ubuntu0.20.04.1 | May 26, 2021 |
| cephfs-shell · Ubuntu 20.04 LTS (focal) | 15.2.12-0ubuntu0.20.04.1 | cephfs-shell 15.2.12-0ubuntu0.20.04.1 | May 26, 2021 |
| libcephfs-java · Ubuntu 20.04 LTS (focal) | 15.2.12-0ubuntu0.20.04.1 | libcephfs-java 15.2.12-0ubuntu0.20.04.1 | May 26, 2021 |
| libcephfs-jni · Ubuntu 20.04 LTS (focal) | 15.2.12-0ubuntu0.20.04.1 | libcephfs-jni 15.2.12-0ubuntu0.20.04.1 | May 26, 2021 |
| libcephfs2 · Ubuntu 20.04 LTS (focal) | 15.2.12-0ubuntu0.20.04.1 | libcephfs2 15.2.12-0ubuntu0.20.04.1 | May 26, 2021 |
| librados2 · Ubuntu 20.04 LTS (focal) | 15.2.12-0ubuntu0.20.04.1 | librados2 15.2.12-0ubuntu0.20.04.1 | May 26, 2021 |
| libradosstriper1 · Ubuntu 20.04 LTS (focal) | 15.2.12-0ubuntu0.20.04.1 | libradosstriper1 15.2.12-0ubuntu0.20.04.1 | May 26, 2021 |
| librbd1 · Ubuntu 20.04 LTS (focal) | 15.2.12-0ubuntu0.20.04.1 | librbd1 15.2.12-0ubuntu0.20.04.1 | May 26, 2021 |
| librgw2 · Ubuntu 20.04 LTS (focal) | 15.2.12-0ubuntu0.20.04.1 | librgw2 15.2.12-0ubuntu0.20.04.1 | May 26, 2021 |
| python3-ceph · Ubuntu 20.04 LTS (focal) | 15.2.12-0ubuntu0.20.04.1 | python3-ceph 15.2.12-0ubuntu0.20.04.1 | May 26, 2021 |
| python3-ceph-argparse · Ubuntu 20.04 LTS (focal) | 15.2.12-0ubuntu0.20.04.1 | python3-ceph-argparse 15.2.12-0ubuntu0.20.04.1 | May 26, 2021 |
| python3-ceph-common · Ubuntu 20.04 LTS (focal) | 15.2.12-0ubuntu0.20.04.1 | python3-ceph-common 15.2.12-0ubuntu0.20.04.1 | May 26, 2021 |
| python3-cephfs · Ubuntu 20.04 LTS (focal) | 15.2.12-0ubuntu0.20.04.1 | python3-cephfs 15.2.12-0ubuntu0.20.04.1 | May 26, 2021 |
| python3-rados · Ubuntu 20.04 LTS (focal) | 15.2.12-0ubuntu0.20.04.1 | python3-rados 15.2.12-0ubuntu0.20.04.1 | May 26, 2021 |
| python3-rbd · Ubuntu 20.04 LTS (focal) | 15.2.12-0ubuntu0.20.04.1 | python3-rbd 15.2.12-0ubuntu0.20.04.1 | May 26, 2021 |
| python3-rgw · Ubuntu 20.04 LTS (focal) | 15.2.12-0ubuntu0.20.04.1 | python3-rgw 15.2.12-0ubuntu0.20.04.1 | May 26, 2021 |
| radosgw · Ubuntu 20.04 LTS (focal) | 15.2.12-0ubuntu0.20.04.1 | radosgw 15.2.12-0ubuntu0.20.04.1 | May 26, 2021 |
| rbd-fuse · Ubuntu 20.04 LTS (focal) | 15.2.12-0ubuntu0.20.04.1 | rbd-fuse 15.2.12-0ubuntu0.20.04.1 | May 26, 2021 |
| rbd-mirror · Ubuntu 20.04 LTS (focal) | 15.2.12-0ubuntu0.20.04.1 | rbd-mirror 15.2.12-0ubuntu0.20.04.1 | May 26, 2021 |
| rbd-nbd · Ubuntu 20.04 LTS (focal) | 15.2.12-0ubuntu0.20.04.1 | rbd-nbd 15.2.12-0ubuntu0.20.04.1 | May 26, 2021 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.