An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse. An attacker who can request a global_id can exploit the ability of any user to request a global_id previously associated with another user, as ceph does not force the reuse of old keys to generate new ones. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Details
- CVSS 3.1 Base Score: 7.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade cephUpgrade ceph16 | Aug 22, 2024 | Apr 15, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Apr 15, 2021 |
| Centos_linux | — | Upgrade ceph-grafana-dashboardsUpgrade libcephfs2-debuginfoUpgrade tcmu-runnerUpgrade ceph-baseUpgrade python3-ceph-argparseUpgrade ceph-mon-debuginfoUpgrade librgw2Upgrade ceph-mdsUpgrade python3-radosUpgrade libcephfs2Upgrade rbd-nbd-debuginfoUpgrade ceph-test-debuginfoUpgrade python3-cephfsUpgrade ceph-ansibleUpgrade ceph-debugsourceUpgrade rbd-mirror-debuginfoUpgrade python3-rgwUpgrade python3-rbdUpgrade librgw2-debuginfoUpgrade librados-develUpgrade librgw-develUpgrade python3-rados-debuginfoUpgrade ceph-base-debuginfoUpgrade ceph-osd-debuginfoUpgrade ceph-mgr-debuginfoUpgrade ceph-radosgw-debuginfoUpgrade python3-cephfs-debuginfoUpgrade librados-devel-debuginfoUpgrade ceph-mds-debuginfoUpgrade rbd-nbdUpgrade librbd-develUpgrade libradosstriper1-debuginfoUpgrade libradosstriper1Upgrade ceph-selinuxUpgrade ceph-common-debuginfoUpgrade python-rgwUpgrade libtcmuUpgrade ceph-fuse-debuginfoUpgrade libcephfs-develUpgrade python-ceph-argparseUpgrade rbd-fuse-debuginfoUpgrade python-cephfsUpgrade ceph-fuseUpgrade ceph-commonUpgrade python3-rgw-debuginfoUpgrade ceph-iscsiUpgrade ceph-radosgwUpgrade python3-rbd-debuginfoUpgrade rbd-mirrorUpgrade ceph-debuginfoUpgrade libradospp-devel | Jun 16, 2021 | Apr 15, 2021 |
| Debian | — | Upgrade ceph | Oct 25, 2023 | Apr 15, 2021 |
| Gentoo Linux | — | Upgrade sys-cluster/ceph. | May 28, 2021 | Apr 15, 2021 |
| Redhat_linux | — | Upgrade ceph-commonUpgrade ceph-baseUpgrade ceph-grafana-dashboardsUpgrade ceph-base-debuginfoUpgrade libradosstriper1-debuginfoUpgrade python3-cephfs-debuginfoUpgrade librados-devel-debuginfoUpgrade librgw2-debuginfoUpgrade ceph-mgr-debuginfoUpgrade python3-rados-debuginfoUpgrade python3-rbdUpgrade ceph-debugsourceUpgrade tcmu-runnerUpgrade ceph-radosgw-debuginfoUpgrade libtcmuUpgrade librgw-develUpgrade libcephfs2Upgrade rbd-nbd-debuginfoUpgrade libradospp-develUpgrade libcephfs2-debuginfoUpgrade python3-rgwUpgrade python3-ceph-argparseUpgrade librados-develUpgrade libcephfs-develUpgrade ceph-test-debuginfoUpgrade ceph-mon-debuginfoUpgrade rbd-mirrorUpgrade ceph-iscsiUpgrade rbd-mirror-debuginfoUpgrade ceph-debuginfoUpgrade python3-rgw-debuginfoUpgrade ceph-common-debuginfoUpgrade python-cephfsUpgrade python3-cephfsUpgrade ceph-mds-debuginfoUpgrade librgw2Upgrade python3-radosUpgrade ceph-mdsUpgrade ceph-ansibleUpgrade ceph-fuse-debuginfoUpgrade ceph-osd-debuginfoUpgrade ceph-selinuxUpgrade python3-rbd-debuginfoUpgrade librbd-develUpgrade ceph-fuseUpgrade ceph-radosgwUpgrade python-ceph-argparseUpgrade rbd-fuse-debuginfoUpgrade python-rgwUpgrade libradosstriper1Upgrade rbd-nbd | Jun 16, 2021 | Apr 15, 2021 |
| Suse | — | Upgrade cephfs-shellUpgrade ceph-mdsUpgrade ceph-radosgwUpgrade librgw2Upgrade ceph-testUpgrade ceph-mgr-dashboardUpgrade ceph-grafana-dashboardsUpgrade ceph-monUpgrade librbd-develUpgrade libcephfs2Upgrade ceph-mgr-diskprediction-cloudUpgrade libcephfs-develUpgrade ceph-immutable-object-cacheUpgrade cephadmUpgrade python3-ceph-commonUpgrade librbd1Upgrade ceph-commonUpgrade librados-develUpgrade librgw-develUpgrade rbd-fuseUpgrade python3-radosUpgrade python3-cephfsUpgrade rados-objclass-develUpgrade librados2Upgrade ceph-fuseUpgrade ceph-mgr-k8seventsUpgrade ceph-mgr-modules-coreUpgrade ceph-mgrUpgrade ceph-baseUpgrade ceph-mgr-cephadmUpgrade libradospp-develUpgrade ceph-osdUpgrade ceph-prometheus-alertsUpgrade python3-rbdUpgrade rbd-nbdUpgrade cephUpgrade python3-rgwUpgrade python3-ceph-argparseUpgrade rbd-mirrorUpgrade ceph-mgr-rookUpgrade ceph-mgr-diskprediction-local | May 5, 2021 | Apr 15, 2021 |
| Ubuntu | — | Upgrade ceph-commonUpgrade ceph-mgr-dashboardUpgrade ceph-mgr-modules-coreUpgrade ceph-mgr-diskprediction-cloudUpgrade cephadmUpgrade ceph-mgr-k8seventsUpgrade ceph-mgr-cephadmUpgrade ceph-mgrUpgrade cephUpgrade radosgwUpgrade ceph-mgr-rookUpgrade ceph-baseUpgrade ceph-mgr-diskprediction-local | Jun 25, 2021 | Apr 15, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub