CVE-2021-20288

Publication date 15 April 2021

Last updated 24 July 2024

Ubuntu priority

Cvss 3 Severity Score

An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse. An attacker who can request a global_id can exploit the ability of any user to request a global_id previously associated with another user, as ceph does not force the reuse of old keys to generate new ones. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

From the Ubuntu Security Team

It was discovered that Ceph contained an authentication flaw, leading to key reuse. An attacker could use this to cause a denial of service or possibly impersonate another user.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
ceph	22.04 LTS jammy	Fixed 16.2.1-0ubuntu1
	21.10 impish	Fixed 16.2.1-0ubuntu1
	21.04 hirsute	Fixed 16.2.6-0ubuntu0.21.04.2
	20.10 groovy	Fixed 15.2.12-0ubuntu0.20.10.1
	20.04 LTS focal	Fixed 15.2.12-0ubuntu0.20.04.1
	18.04 LTS bionic	Ignored
	16.04 LTS xenial	Ignored
	14.04 LTS trusty	Ignored

Notes

mdeslaur

we will not be backporting this fix to Ubuntu 18.04 LTS and earlier. this is fixed in 16.2.1 in hirsute-updates but has not been pushed to the security pocket

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
ceph	Upstream: 059eabc Upstream: 05b3b6a

Severity score breakdown

Parameter	Value
Base score	7.2 · High
Attack vector	Network
Attack complexity	Low
Privileges required	High
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity impact	High
Availability impact	High
Vector	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H