Read the docs
TI-2021-03578 Aliases CVE-2021-20288GHSA-39jx-6759-44c6

Improper authentication in ceph

Priority LOW 36CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 6 fixed, 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-287.

Summary

An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse. An attacker who can request a global_id can exploit the ability of any user to request a global_id previously associated with another user, as ceph does not force the reuse of old keys to generate new ones. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Why it matters now

EPSS 0.0211 81st percentileScored 2026-11-07
Fix Partial Red Hat: 2 advisoriesRed Hat: 6 fixed, 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—cephceph 14.2.20—No fix listedCNA
  • ceph Vendor— Affected ceph 14.2.20 Fixed in — No fix listed CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:ceph:*:*:*:*:*:*:*:*before 14.2.21Vulnerablebackstage
cpe:2.3:a:redhat:ceph_storage:4.0:*:*:*:*:*:*:*4.0VulnerableRed Hat
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*32VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*33VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*34VulnerableFedoraproject
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
  • cpe:2.3:a:linuxfoundation:ceph:*:*:*:*:*:*:*:* Versions before 14.2.21 Vulnerable ·backstage
  • cpe:2.3:a:redhat:ceph_storage:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat
  • cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian

Remediation

Red Hat 2 advisories

  • RHSA-2022:1394 Released 2022-04-19 · Red Hat rating Important
    Red Hat Ceph Storage 3 Security and Bug Fix update
    • Red Hat Ceph Storage 3 MON - ELS ceph-2:12.2.12-141.el7cp, ceph-base-2:12.2.12-141.el7cp, ceph-common-2:12.2.12-141.el7cp +17
    • Red Hat Ceph Storage 3 OSD - ELS ceph-2:12.2.12-141.el7cp, ceph-base-2:12.2.12-141.el7cp, ceph-common-2:12.2.12-141.el7cp +16
    • Red Hat Ceph Storage 3 Tools - ELS ceph-2:12.2.12-141.el7cp, ceph-base-2:12.2.12-141.el7cp, ceph-common-2:12.2.12-141.el7cp +18
  • RHSA-2021:2445 Released 2021-06-15 · Red Hat rating Important
    Red Hat Ceph Storage 4.2 Security and Bug Fix Update
    • Red Hat Ceph Storage 4.2 MON ceph-2:14.2.11-181.el7cp, ceph-2:14.2.11-181.el8cp, ceph-base-2:14.2.11-181.el7cp +47
    • Red Hat Ceph Storage 4.2 OSD ceph-2:14.2.11-181.el7cp, ceph-2:14.2.11-181.el8cp, ceph-base-2:14.2.11-181.el7cp +39
    • Red Hat Ceph Storage 4.2 Tools ceph-2:14.2.11-181.el7cp, ceph-2:14.2.11-181.el8cp, ceph-base-2:14.2.11-181.el7cp +47

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ceph Storage 2AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Will not fix
Red Hat Openshift Container Storage 4AffectedNo fix planned: Will not fix
Red Hat Ceph Storage 3 MON - ELSFixed RHSA-2022:1394
Red Hat Ceph Storage 3 OSD - ELSFixed RHSA-2022:1394
Red Hat Ceph Storage 3 Tools - ELSFixed RHSA-2022:1394
Red Hat Ceph Storage 4.2 MONFixed RHSA-2021:2445
Red Hat Ceph Storage 4.2 OSDFixed RHSA-2021:2445
Red Hat Ceph Storage 4.2 ToolsFixed RHSA-2021:2445
Not affected: 6 products
  • Red Hat Ceph Storage 3 Tools - ELS
  • Red Hat Ceph Storage 4.2 MON
  • Red Hat Ceph Storage 4.2 Tools
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-20288
  2. 2026-10-03 Alias added: GHSA-39jx-6759-44c6

References

Patch 1

Advisory 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences