7.2

CVE-2021-20288: debian debian_linux Improper Authentication

Modified
AliasesMGASA-2021-0207SUSE-SU-2021:1474-1RHSA-2022:1394
Published 15-04-2021Last modified 03-08-2024

Vulnerability summary

CVE-2021-20288 is a high (CVSS 7.2) Improper Authentication vulnerability in debian debian_linux. EPSS estimates a 2.13% chance of exploitation in the next 30 days, higher than 81.9% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 7.2, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
7.2/10
010
High · v3.1 (NVD)
EPSS score
2.13%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 6 · Related 4
DLA-3629-1RHSA-2021:2445SUSE-SU-2021:1472-1SUSE-SU-2021:1473-1USN-4998-1USN-5128-1

Timeline

  1. 15-04-2021
    PublishedVulnerability first disclosed.
  2. 03-08-2024
    Last modifiedVulnerability information updated.

Description

An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse. An attacker who can request a global_id can exploit the ability of any user to request a global_id previously associated with another user, as ceph does not force the reuse of old keys to generate new ones. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS metrics

6 scores · 5 sources · 2 versions

EPSS trend

Probability

2.13%

Chance of exploitation in the next 30 days

Percentile

82%

Versus all other CVEs

30-day change

No change 0.00 pp

From 2.13% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, administrative account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat27 products
  • ceph_storage4.0
  • ceph< 2:12.2.12-141.el7cp
  • ceph-base< 2:12.2.12-141.el7cp
  • ceph-common< 2:12.2.12-141.el7cp
  • ceph-debuginfo< 2:12.2.12-141.el7cp
Opensuse3 products
  • benji&distro=openSUSE Tumbleweed< 0.15.0-1.2
  • ceph-test&distro=openSUSE Leap 15.2< 15.2.11.83+g8a15f484c2-lp152.2.15.1
  • ceph&distro=openSUSE Leap 15.2< 15.2.11.83+g8a15f484c2-lp152.2.15.1
Suse3 products
  • ceph&distro=SUSE Enterprise Storage 7< 15.2.11.83+g8a15f484c2-3.20.1
  • ceph&distro=SUSE Linux Enterprise Module for Basesystem 15 SP2< 15.2.11.83+g8a15f484c2-3.20.1
  • ceph&distro=SUSE Linux Enterprise Module for Basesystem 15 SP3< 15.2.11.83+g8a15f484c2-3.20.1
Alpine2 products
  • ceph< 14.2.20-r0 | < 16.2.3-r0
  • ceph16< 16.2.3-r0
Debian2 products
Fedoraproject1 product
Linuxfoundation1 product
Mageia1 product
  • ceph< 15.2.11-1.mga8
Ubuntu1 product
  • cephAll versions (No fix recorded) | < 15.2.12-0ubuntu0.20.04.1

9 vendors · 41 products

References

30 links
Show all 30 references