CVE-2021-20288 log

Severity High
Remote Yes
Type Insufficient validation
An authentication flaw was found in ceph. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse. An attacker who can request a global_id can exploit the ability of any user to request a global_id previously associated with another user, as ceph does not force the reuse of old keys to generate new ones.
Group Package Affected Fixed Severity Status Ticket
AVG-1826 ceph 15.2.10-1 High Vulnerable FS#70451