---

CVE-2021-20288 - log back

CVE-2021-20288 edited at 14 May 2021 19:38:11
References	https://www.openwall.com/lists/oss-security/2021/04/14/2 + https://bugzilla.redhat.com/show_bug.cgi?id=1938031 https://github.com/ceph/ceph/commit/1f57617d5edb45a8a696eac7c910e8fc44c934a3 https://github.com/ceph/ceph/commit/9f3efe7cd1a780b91e5c8cfee192a0c51d0151dc

CVE-2021-20288 edited at 14 May 2021 19:37:32

Description

- An authentication flaw was found in ceph before version 15.2.12. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse. An attacker who can request a global_id can exploit the ability of any user to request a global_id previously associated with another user, as ceph does not force the reuse of old keys to generate new ones. + An authentication flaw was found in ceph before version 15.2.11. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse. An attacker who can request a global_id can exploit the ability of any user to request a global_id previously associated with another user, as ceph does not force the reuse of old keys to generate new ones.

CVE-2021-20288 edited at 14 May 2021 19:35:36

Description

- An authentication flaw was found in ceph. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse. An attacker who can request a global_id can exploit the ability of any user to request a global_id previously associated with another user, as ceph does not force the reuse of old keys to generate new ones. + An authentication flaw was found in ceph before version 15.2.12. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse. An attacker who can request a global_id can exploit the ability of any user to request a global_id previously associated with another user, as ceph does not force the reuse of old keys to generate new ones.

CVE-2021-20288 edited at 14 Apr 2021 20:18:37
References	https://www.openwall.com/lists/oss-security/2021/04/14/2 - https://github.com/ceph/ceph/commit/f3a4166379b12d4a7bba667fe761e5b660552db1 + https://github.com/ceph/ceph/commit/1f57617d5edb45a8a696eac7c910e8fc44c934a3 + https://github.com/ceph/ceph/commit/9f3efe7cd1a780b91e5c8cfee192a0c51d0151dc

CVE-2021-20288 edited at 14 Apr 2021 20:01:46
Severity	- Unknown + High
Remote	- Unknown + Remote
Description	- An authentication flaw was found in ceph. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse. + An authentication flaw was found in ceph. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse. An attacker who can request a global_id can exploit the ability of any user to request a global_id previously associated with another user, as ceph does not force the reuse of old keys to generate new ones.
References	+ https://www.openwall.com/lists/oss-security/2021/04/14/2 https://github.com/ceph/ceph/commit/f3a4166379b12d4a7bba667fe761e5b660552db1 - https://www.openwall.com/lists/oss-security/2021/04/14/2

CVE-2021-20288 created at 14 Apr 2021 20:00:41
Severity	+ Unknown
Remote	+ Unknown
Type	+ Insufficient validation
Description	+ An authentication flaw was found in ceph. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse.
References	+ https://github.com/ceph/ceph/commit/f3a4166379b12d4a7bba667fe761e5b660552db1 + https://www.openwall.com/lists/oss-security/2021/04/14/2
Notes