Read the docs
TI-2021-02876 Aliases CVE-2021-3979GHSA-23g5-cwwr-8xhw

Broken or risky cryptographic algorithm in ceph

Priority LOW 30CWE-327Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure, Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 6 fixed, 4 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-327 and CWE-287.

Summary

A key length flaw was found in Red Hat Ceph Storage. An attacker can exploit the fact that the key length is incorrectly passed in an encryption algorithm to create a non random key, which is weaker and can be exploited for loss of confidentiality and integrity on encrypted disks.

Why it matters now

EPSS 0.00597 48th percentileScored 2026-11-07
Fix Partial Red Hat: 2 advisoriesRed Hat: 6 fixed, 4 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—cephNot-Known—No fix listedCNA
  • ceph Vendor— Affected Not-Known Fixed in — No fix listed CNA

CPE configurations NVD · 14

CPEVersionsRoleVendor
cpe:2.3:a:redhat:ceph_storage:3.0:*:*:*:*:*:*:*3.0VulnerableRed Hat
cpe:2.3:a:redhat:ceph_storage:4.3:*:*:*:*:*:*:*4.3VulnerableRed Hat
cpe:2.3:a:redhat:ceph_storage:5.1:*:*:*:*:*:*:*5.1VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_storage:4.0:*:*:*:*:*:*:*4.0VulnerableRed Hat
cpe:2.3:a:redhat:openshift_data_foundation:4.0:*:*:*:*:*:*:*4.0VulnerableRed Hat
cpe:2.3:a:redhat:openstack_platform:13.0:*:*:*:*:*:*:*13.0VulnerableRed Hat
cpe:2.3:o:redhat:ceph_storage_for_ibm_z_systems:4.0:*:*:*:*:*:*:*4.0VulnerableRed Hat
cpe:2.3:a:redhat:ceph_storage:4.0:*:*:*:*:*:*:*4.0VulnerableRed Hat
cpe:2.3:a:redhat:ceph_storage:5.0:*:*:*:*:*:*:*5.0VulnerableRed Hat
cpe:2.3:a:redhat:ceph_storage_for_power:4.0:*:*:*:*:*:*:*4.0VulnerableRed Hat
  • cpe:2.3:a:redhat:ceph_storage:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:ceph_storage:4.3:*:*:*:*:*:*:* Versions 4.3 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:ceph_storage:5.1:*:*:*:*:*:*:* Versions 5.1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_storage:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_data_foundation:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openstack_platform:13.0:*:*:*:*:*:*:* Versions 13.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:ceph_storage_for_ibm_z_systems:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:ceph_storage:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:ceph_storage:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:ceph_storage_for_power:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat
Show 4 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0Running onRed Hat
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*35VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*37VulnerableFedoraproject
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
  • cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject

Remediation

Red Hat 2 advisories

  • RHSA-2022:1716 Released 2022-05-05 · Red Hat rating Moderate
    Red Hat Ceph Storage 4.3 Security and Bug Fix update
    • Red Hat Ceph Storage 4.3 MON ceph-2:14.2.22-110.el7cp, ceph-2:14.2.22-110.el8cp, ceph-base-2:14.2.22-110.el7cp +47
    • Red Hat Ceph Storage 4.3 OSD ceph-2:14.2.22-110.el7cp, ceph-2:14.2.22-110.el8cp, ceph-base-2:14.2.22-110.el7cp +39
    • Red Hat Ceph Storage 4.3 Tools ceph-2:14.2.22-110.el7cp, ceph-2:14.2.22-110.el8cp, ceph-base-2:14.2.22-110.el7cp +47
  • RHSA-2022:1174 Released 2022-04-04 · Red Hat rating Moderate
    Red Hat Ceph Storage 5.1 Security, Enhancement, and Bug Fix update
    • Red Hat Ceph Storage 5.1 MON ceph-2:16.2.7-98.el8cp, ceph-base-2:16.2.7-98.el8cp, ceph-common-2:16.2.7-98.el8cp +30
    • Red Hat Ceph Storage 5.1 OSD ceph-2:16.2.7-98.el8cp, ceph-base-2:16.2.7-98.el8cp, ceph-common-2:16.2.7-98.el8cp +20
    • Red Hat Ceph Storage 5.1 Tools ceph-2:16.2.7-98.el8cp, ceph-base-2:16.2.7-98.el8cp, ceph-common-2:16.2.7-98.el8cp +28

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ceph Storage 3AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Will not fix
Red Hat Openshift Container Storage 4AffectedNo fix planned: Out of support scope
Red Hat Openshift Data Foundation 4AffectedNo fix planned: Will not fix
Red Hat Ceph Storage 4.3 MONFixed RHSA-2022:1716
Red Hat Ceph Storage 4.3 OSDFixed RHSA-2022:1716
Red Hat Ceph Storage 4.3 ToolsFixed RHSA-2022:1716
Red Hat Ceph Storage 5.1 MONFixed RHSA-2022:1174
Red Hat Ceph Storage 5.1 OSDFixed RHSA-2022:1174
Red Hat Ceph Storage 5.1 ToolsFixed RHSA-2022:1174
Not affected: 7 products
  • Red Hat Ceph Storage 4.3 MON
  • Red Hat Ceph Storage 4.3 Tools
  • Red Hat Ceph Storage 5.1 MON
  • Red Hat Ceph Storage 5.1 Tools
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-3979
  2. 2026-10-03 Alias added: GHSA-23g5-cwwr-8xhw

References

Patch 2

Advisory 4

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences