Skip to content
Fencer Vulns
high 7.2

CVE-2021-20288 json

An authentication flaw was found in ceph in versions before 14.2.20.

published 2021-04-15 5 y ago modified 2026-09-08 2 mo ago also BIT-ceph-2021-20288 , EUVD-2021-7716

cvss
7.2
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.1%
EPSS 2.1% chance of exploitation in 30 days, percentile 81%
public exploits
0
none known

Summary

An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse. An attacker who can request a global_id can exploit the ability of any user to request a global_id previously associated with another user, as ceph does not force the reuse of old keys to generate new ones. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Patch / fix

  • bitnami ceph 14.2.21
  • linuxfoundation ceph 14.2.21
  • ceph Debian 14, Debian 13, Debian 12 14.2.20-1

debian advisories DEBIAN-CVE-2021-20288

  • ceph Ubuntu 20.04 LTS 15.2.12-0ubuntu0.20.04.1

ubuntu advisories UBUNTU-CVE-2021-20288

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • ceph ceph storage 4 2:14.2.11-181.el7cp
  • ceph ceph storage 4 2:14.2.11-181.el8cp
  • librbd1 ceph storage 4 2:14.2.11-181.el7cp
  • librbd1 ceph storage 4 2:14.2.11-181.el8cp
  • librgw2 ceph storage 4 2:14.2.11-181.el7cp
  • librgw2 ceph storage 4 2:14.2.11-181.el8cp
  • rbd-nbd ceph storage 4 2:14.2.11-181.el7cp
  • rbd-nbd ceph storage 4 2:14.2.11-181.el8cp

red hat advisories RHSA-2021:2445RHSA-2022:1394

  • ceph SLE Module for Basesystem 15 SP3, SLE Module for Basesystem 15 SP2, Enterprise Storage 7 15.2.11.83+g8a15f484c2-3.20.1
  • ceph SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLES 15 SP1-BCL +6 more 14.2.20.402+g6aa76c6815-3.60.1
  • deepsea Enterprise Storage 6 0.9.35+git.0.5a1dc9fe-3.34.1

suse advisories SUSE-SU-2021:1474-1SUSE-SU-2021:1473-1SUSE-SU-2021:1472-1

  • benji openSUSE Tumbleweed 0.15.0-1.2
  • ceph openSUSE Leap 15.2 15.2.11.83+g8a15f484c2-lp152.2.15.1
  • ceph-test openSUSE Leap 15.2 15.2.11.83+g8a15f484c2-lp152.2.15.1

opensuse advisories openSUSE-SU-2024:10649-1openSUSE-SU-2021:0672-1

  • ceph Alpine 3.12, Alpine 3.11 14.2.20-r0
  • ceph Alpine 3.16, Alpine 3.15, Alpine 3.14 16.2.3-r0
  • ceph16 Alpine 3.18, Alpine 3.17 16.2.3-r0

alpine advisories ALPINE-CVE-2021-20288

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-20288 updated cvss 8.0

ceph: Unauthorized global_id reuse in cephx

  • Red Hat Ceph Storage 2 ceph, librbd1, librgw2, ceph-mds, ceph-mon, ceph-osd, +12 more
    affected: no fix planned “Out of support scope”
  • Red Hat Openshift Container Storage 4 ceph Red Hat OpenStack Platform 13 (Queens) librbd1, librgw2, ceph-fuse, librados2, libcephfs2, python-rbd, +6 more
    affected: no fix planned “Will not fix”
  • Red Hat Ceph Storage 3 MON - ELS ceph 12.2.12-141.el7cp, librbd1 12.2.12-141.el7cp, librgw2 12.2.12-141.el7cp, ceph-mgr 12.2.12-141.el7cp, ceph-mon 12.2.12-141.el7cp, ceph-base 12.2.12-141.el7cp, +10 more Red Hat Ceph Storage 3 OSD - ELS ceph 12.2.12-141.el7cp, librbd1 12.2.12-141.el7cp, librgw2 12.2.12-141.el7cp, ceph-osd 12.2.12-141.el7cp, ceph-base 12.2.12-141.el7cp, ceph-test 12.2.12-141.el7cp, +9 more Red Hat Ceph Storage 3 Tools - ELS ceph 12.2.12-141.el7cp, librbd1 12.2.12-141.el7cp, librgw2 12.2.12-141.el7cp, ceph-mds 12.2.12-141.el7cp, ceph-base 12.2.12-141.el7cp, ceph-fuse 12.2.12-141.el7cp, +11 more
    fixed: vendor fix RHSA-2022:1394
  • Red Hat Ceph Storage 4.2 MON ceph 14.2.11-181.el7cp, ceph 14.2.11-181.el8cp, librbd1 14.2.11-181.el7cp, librbd1 14.2.11-181.el8cp, librgw2 14.2.11-181.el7cp, librgw2 14.2.11-181.el8cp, +38 more Red Hat Ceph Storage 4.2 OSD ceph 14.2.11-181.el7cp, ceph 14.2.11-181.el8cp, librbd1 14.2.11-181.el7cp, librbd1 14.2.11-181.el8cp, librgw2 14.2.11-181.el7cp, librgw2 14.2.11-181.el8cp, +26 more Red Hat Ceph Storage 4.2 Tools ceph 14.2.11-181.el7cp, ceph 14.2.11-181.el8cp, librbd1 14.2.11-181.el7cp, librbd1 14.2.11-181.el8cp, librgw2 14.2.11-181.el7cp, librgw2 14.2.11-181.el8cp, +34 more
    fixed: vendor fix RHSA-2021:2445
  • Red Hat Ceph Storage 3 Tools - ELS ceph-ansible 3.2.59-1.el7cp Red Hat Ceph Storage 4.2 MON python-waitress 1.4.2-1.el8ost, python3-waitress 1.4.2-1.el8ost Red Hat Ceph Storage 4.2 Tools libtcmu 1.5.2-4.el7cp, libtcmu 1.5.2-4.el8cp, ceph-iscsi 3.4-4.el7cp, ceph-iscsi 3.4-4.el8cp, tcmu-runner 1.5.2-4.el7cp, tcmu-runner 1.5.2-4.el8cp, +2 more Red Hat Enterprise Linux 7 librbd1, librados2, python-rbd, ceph-common, python-rados Red Hat Enterprise Linux 8 librbd1, librados2, libcephfs2, libradosstriper1 Red Hat Enterprise Linux 9 librbd1, librados2
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.11% chance of exploitation in the next 30 days, higher than 81% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P
OSV 3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
bitnami ceph
<14.2.21
14.2.21

Affected products

  • n/a ceph

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.