CVE-2021-3979

Advisory lineage Upstream: 0 Downstream: 12
Modified
Published: 25 Aug 2022, 00:00
Last modified:03 Nov 2025, 18:08

Vulnerability Summary

Overall Risk (default)
medium
26/100
CVSS Score
6.5 MEDIUM
v3.1 (nvd)
EPSS Score
0.27% LOW
0% probability +0.05%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

25 Aug 2022, 00:00
Published
Vulnerability first disclosed
03 Nov 2025, 18:08
Last Modified
Vulnerability information updated

Description

A key length flaw was found in Red Hat Ceph Storage. An attacker can exploit the fact that the key length is incorrectly passed in an encryption algorithm to create a non random key, which is weaker and can be exploited for loss of confidentiality and integrity on encrypted disks.

CVSS Metrics

  • v3.1•MEDIUM•Score: 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS Trends

Current EPSS score: 0.27%• Percentile: 51%

Techniques & Countermeasures

  • CWE-327•Use of a Broken or Risky Cryptographic Algorithm

    The product uses a broken or risky cryptographic algorithm or protocol.

  • CWE-287•Improper Authentication

    When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Affected Systems

  • fedoraproject•fedora

    35 | 37

  • redhat•ceph_storage

    3.0 | 4.3 | 5.1 | 4.0 | 5.0

  • redhat•ceph_storage_for_ibm_z_systems

    4.0

  • redhat•ceph_storage_for_power

    4.0

  • redhat•openshift_container_storage

    4.0

  • redhat•openshift_data_foundation

    4.0

  • redhat•openstack_platform

    13.0

References (8)