{"id":"CVE-2021-20288","aliases":["ALPINE-CVE-2021-20288","BIT-ceph-2021-20288","DEBIAN-CVE-2021-20288","DLA-3629-1","EUVD-2021-7716","GHSA-39jx-6759-44c6","MGASA-2021-0207","OESA-2022-1715","RHSA-2021:2445","RHSA-2022:1394","SUSE-SU-2021:1472-1","SUSE-SU-2021:1473-1","SUSE-SU-2021:1474-1","UBUNTU-CVE-2021-20288","USN-4998-1","USN-5128-1","openSUSE-SU-2021:0672-1","openSUSE-SU-2024:10649-1","openSUSE-SU-2024:10676-1"],"status":"published","title":"An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles...","description":"An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse. An attacker who can request a global_id can exploit the ability of any user to request a global_id previously associated with another user, as ceph does not force the reuse of old keys to generate new ones. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.0211,"percentile":0.81946,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287"],"published":"2021-04-15T00:00:00Z","modified":"2026-11-03T06:32:46Z","fixes":[{"ecosystem":"Alpine:v3.11","package":"ceph","fixed_in":["14.2.20-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"ceph","fixed_in":["14.2.20-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"ceph","fixed_in":["16.2.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"ceph","fixed_in":["16.2.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"ceph","fixed_in":["16.2.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"ceph16","fixed_in":["16.2.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"ceph16","fixed_in":["16.2.3-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"ceph","fixed_in":["14.2.21"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"ceph","fixed_in":["14.2.20-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ceph","fixed_in":["14.2.20-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ceph","fixed_in":["14.2.20-1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"ceph","fixed_in":["15.2.11-1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"ceph","fixed_in":["12.2.8-22.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"ceph","fixed_in":["12.2.8-22.oe1"],"sources":["osv"]},{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph","fixed_in":["2:12.2.12-141.el7cp"],"sources":["osv"]},{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-base","fixed_in":["2:12.2.12-141.el7cp"],"sources":["osv"]},{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-common","fixed_in":["2:12.2.12-141.el7cp"],"sources":["osv"]},{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-debuginfo","fixed_in":["2:12.2.12-141.el7cp"],"sources":["osv"]},{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-mgr","fixed_in":["2:12.2.12-141.el7cp"],"sources":["osv"]},{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-mon","fixed_in":["2:12.2.12-141.el7cp"],"sources":["osv"]},{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-selinux","fixed_in":["2:12.2.12-141.el7cp"],"sources":["osv"]},{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-test","fixed_in":["2:12.2.12-141.el7cp"],"sources":["osv"]},{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"libcephfs-devel","fixed_in":["2:12.2.12-141.el7cp"],"sources":["osv"]},{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"libcephfs2","fixed_in":["2:12.2.12-141.el7cp"],"sources":["osv"]},{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"librados-devel","fixed_in":["2:12.2.12-141.el7cp"],"sources":["osv"]},{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"librados2","fixed_in":["2:12.2.12-141.el7cp"],"sources":["osv"]},{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"libradosstriper1","fixed_in":["2:12.2.12-141.el7cp"],"sources":["osv"]},{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"librbd-devel","fixed_in":["2:12.2.12-141.el7cp"],"sources":["osv"]},{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"librbd1","fixed_in":["2:12.2.12-141.el7cp"],"sources":["osv"]},{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"librgw-devel","fixed_in":["2:12.2.12-141.el7cp"],"sources":["osv"]},{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"librgw2","fixed_in":["2:12.2.12-141.el7cp"],"sources":["osv"]},{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"python-cephfs","fixed_in":["2:12.2.12-141.el7cp"],"sources":["osv"]},{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"python-rados","fixed_in":["2:12.2.12-141.el7cp"],"sources":["osv"]},{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"python-rbd","fixed_in":["2:12.2.12-141.el7cp"],"sources":["osv"]},{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"python-rgw","fixed_in":["2:12.2.12-141.el7cp"],"sources":["osv"]},{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-osd","fixed_in":["2:12.2.12-141.el7cp"],"sources":["osv"]},{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-fuse","fixed_in":["2:12.2.12-141.el7cp"],"sources":["osv"]},{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-mds","fixed_in":["2:12.2.12-141.el7cp"],"sources":["osv"]},{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-radosgw","fixed_in":["2:12.2.12-141.el7cp"],"sources":["osv"]},{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"rbd-mirror","fixed_in":["2:12.2.12-141.el7cp"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"ceph","fixed_in":["15.2.11.83+g8a15f484c2-3.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"ceph","fixed_in":["15.2.11.83+g8a15f484c2-3.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7","package":"ceph","fixed_in":["15.2.11.83+g8a15f484c2-3.20.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"ceph","fixed_in":["15.2.12-0ubuntu0.20.04.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"ceph","fixed_in":["15.2.11.83+g8a15f484c2-lp152.2.15.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"ceph-test","fixed_in":["15.2.11.83+g8a15f484c2-lp152.2.15.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"benji","fixed_in":["0.15.0-1.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.11","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.20-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.20-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.2.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.2.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.2.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"ceph16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.2.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"ceph16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.2.3-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"ceph","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"14.2.21"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.20-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.20-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.20-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.11+dfsg1-2.1+deb10u1"}]}],"versions":["12.2.11+dfsg1-2.1"],"bundled":12},{"source":"osv","ecosystem":"Mageia:8","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.11-1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.8-22.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.8-22.oe1"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph-grafana-dashboards","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph-mgr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph-mgr-dashboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph-mgr-diskprediction-local","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph-mgr-k8sevents","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph-mgr-rook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph-mon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"libcephfs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"libcephfs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"librados-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"librados2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"libradospp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"libradosstriper1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"librbd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"librbd1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"librgw-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"librgw2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"python-ceph-argparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"python-cephfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"python-rados","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"python-rbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"python-rgw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph-osd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph-fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph-mds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"ceph-radosgw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"rbd-mirror","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el7","package":"rbd-nbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el7cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-base-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-common-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-fuse-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-grafana-dashboards","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-mds-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-mgr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-mgr-dashboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-mgr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-mgr-diskprediction-local","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-mgr-k8sevents","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-mgr-rook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-mon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-mon-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-osd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-radosgw-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-test-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"libcephfs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"libcephfs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"libcephfs2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"librados-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"librados-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"librados2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"librados2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"libradospp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"libradosstriper1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"libradosstriper1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"librbd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"librbd1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"librbd1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"librgw-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"librgw2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"librgw2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"python3-ceph-argparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"python3-cephfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"python3-cephfs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"python3-rados","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"python3-rados-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"python3-rbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"python3-rbd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"python3-rgw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"python3-rgw-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"rbd-fuse-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"rbd-mirror-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"rbd-nbd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-osd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-mds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"ceph-radosgw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"rbd-mirror","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:4::el8","package":"rbd-nbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.2.11-181.el8cp"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-141.el7cp"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-141.el7cp"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-141.el7cp"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-141.el7cp"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-mgr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-141.el7cp"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-mon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-141.el7cp"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-141.el7cp"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-141.el7cp"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"libcephfs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-141.el7cp"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"libcephfs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-141.el7cp"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"librados-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-141.el7cp"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"librados2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-141.el7cp"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"libradosstriper1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-141.el7cp"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"librbd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-141.el7cp"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"librbd1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-141.el7cp"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"librgw-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-141.el7cp"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"librgw2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-141.el7cp"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"python-cephfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-141.el7cp"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"python-rados","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-141.el7cp"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"python-rbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-141.el7cp"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"python-rgw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-141.el7cp"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-osd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-141.el7cp"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-141.el7cp"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-mds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-141.el7cp"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-radosgw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-141.el7cp"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"rbd-mirror","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.12-141.el7cp"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"deepsea","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.35+git.0.5a1dc9fe-3.34.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.20.402+g6aa76c6815-3.60.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.20.402+g6aa76c6815-3.60.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.20.402+g6aa76c6815-3.60.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.20.402+g6aa76c6815-3.60.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.20.402+g6aa76c6815-3.60.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.0","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.20.402+g6aa76c6815-3.60.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.20.402+g6aa76c6815-3.60.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server 4.0","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.20.402+g6aa76c6815-3.60.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.20.402+g6aa76c6815-3.60.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.11.83+g8a15f484c2-3.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.11.83+g8a15f484c2-3.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.11.83+g8a15f484c2-3.20.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.67.4-0ubuntu2","0.67.4-0ubuntu3","0.72-0ubuntu1","0.72.1-0ubuntu1","0.72.1-2","0.72.1-3","0.72.2-1","0.72.2-2","0.78-0ubuntu1","0.79-0ubuntu1","0.80.1-0ubuntu1","0.80.1-0ubuntu1.1","0.80.5-0ubuntu0.14.04.1","0.80.7-0ubuntu0.14.04.1","0.80.9-0ubuntu0.14.04.1","0.80.9-0ubuntu0.14.04.2","0.80.10-0ubuntu0.14.04.1","0.80.10-0ubuntu1.14.04.2","0.80.10-0ubuntu1.14.04.3","0.80.11-0ubuntu1.14.04.1","0.80.11-0ubuntu1.14.04.2","0.80.11-0ubuntu1.14.04.3","0.80.11-0ubuntu1.14.04.4","0.80.11-0ubuntu1.14.04.4+esm2","0.80.11-0ubuntu1.14.04.4+esm3","0.80.11-0ubuntu1.14.04.4+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.94.3-0ubuntu2","0.94.5-0ubuntu1","9.2.0-0ubuntu3","9.2.0-0ubuntu4","9.2.0-0ubuntu5","9.2.0-0ubuntu6","10.0.2-0ubuntu1","10.0.3-0ubuntu1","10.0.5-0ubuntu1","10.1.0-0ubuntu1","10.1.1-0ubuntu1","10.1.2-0ubuntu1","10.2.0-0ubuntu0.16.04.1","10.2.0-0ubuntu0.16.04.2","10.2.2-0ubuntu0.16.04.2","10.2.3-0ubuntu0.16.04.2","10.2.5-0ubuntu0.16.04.1","10.2.6-0ubuntu0.16.04.1","10.2.7-0ubuntu0.16.04.1","10.2.9-0ubuntu0.16.04.1","10.2.10-0ubuntu0.16.04.1","10.2.11-0ubuntu0.16.04.1","10.2.11-0ubuntu0.16.04.2","10.2.11-0ubuntu0.16.04.3","10.2.11-0ubuntu0.16.04.3+esm1","10.2.11-0ubuntu0.16.04.3+esm2","10.2.11-0ubuntu0.16.04.3+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["12.2.0-0ubuntu1","12.2.1-0ubuntu1","12.2.2-0ubuntu1","12.2.2-0ubuntu2","12.2.4-0ubuntu1","12.2.4-0ubuntu1.1","12.2.7-0ubuntu0.18.04.1","12.2.8-0ubuntu0.18.04.1","12.2.8-0ubuntu0.18.04.2","12.2.11-0ubuntu0.18.04.1","12.2.11-0ubuntu0.18.04.2","12.2.12-0ubuntu0.18.04.1","12.2.12-0ubuntu0.18.04.2","12.2.12-0ubuntu0.18.04.3","12.2.12-0ubuntu0.18.04.4","12.2.12-0ubuntu0.18.04.5","12.2.13-0ubuntu0.18.04.2","12.2.13-0ubuntu0.18.04.3","12.2.13-0ubuntu0.18.04.4","12.2.13-0ubuntu0.18.04.5","12.2.13-0ubuntu0.18.04.6","12.2.13-0ubuntu0.18.04.7","12.2.13-0ubuntu0.18.04.8","12.2.13-0ubuntu0.18.04.10","12.2.13-0ubuntu0.18.04.11","12.2.13-0ubuntu0.18.04.11+esm1","12.2.13-0ubuntu0.18.04.11+esm2","12.2.13-0ubuntu0.18.04.11+esm3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.12-0ubuntu0.20.04.1"}]}],"versions":["14.2.2-0ubuntu3","14.2.2-0ubuntu4","14.2.4-0ubuntu1","14.2.4-0ubuntu2","14.2.4-0ubuntu3","15.1.0-0ubuntu2","15.1.0-0ubuntu3","15.1.1-0ubuntu1","15.2.0-0ubuntu1","15.2.0-0ubuntu2","15.2.1-0ubuntu1","15.2.1-0ubuntu2","15.2.3-0ubuntu0.20.04.1","15.2.3-0ubuntu0.20.04.2","15.2.5-0ubuntu0.20.04.1","15.2.7-0ubuntu0.20.04.1","15.2.7-0ubuntu0.20.04.2","15.2.8-0ubuntu0.20.04.1","15.2.11-0ubuntu0.20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.12-0ubuntu0.20.04.1"}]}],"versions":["14.2.2-0ubuntu3","14.2.2-0ubuntu4","14.2.4-0ubuntu1","14.2.4-0ubuntu2","14.2.4-0ubuntu3","15.1.0-0ubuntu2","15.1.0-0ubuntu3","15.1.1-0ubuntu1","15.2.0-0ubuntu1","15.2.0-0ubuntu2","15.2.1-0ubuntu1","15.2.1-0ubuntu2","15.2.3-0ubuntu0.20.04.1","15.2.3-0ubuntu0.20.04.2","15.2.5-0ubuntu0.20.04.1","15.2.7-0ubuntu0.20.04.1","15.2.7-0ubuntu0.20.04.2","15.2.8-0ubuntu0.20.04.1","15.2.11-0ubuntu0.20.04.2"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.13-0ubuntu0.18.04.10"}]}],"versions":["12.2.0-0ubuntu1","12.2.1-0ubuntu1","12.2.2-0ubuntu1","12.2.2-0ubuntu2","12.2.4-0ubuntu1","12.2.4-0ubuntu1.1","12.2.7-0ubuntu0.18.04.1","12.2.8-0ubuntu0.18.04.1","12.2.8-0ubuntu0.18.04.2","12.2.11-0ubuntu0.18.04.1","12.2.11-0ubuntu0.18.04.2","12.2.12-0ubuntu0.18.04.1","12.2.12-0ubuntu0.18.04.2","12.2.12-0ubuntu0.18.04.3","12.2.12-0ubuntu0.18.04.4","12.2.12-0ubuntu0.18.04.5","12.2.13-0ubuntu0.18.04.2","12.2.13-0ubuntu0.18.04.3","12.2.13-0ubuntu0.18.04.4","12.2.13-0ubuntu0.18.04.5","12.2.13-0ubuntu0.18.04.6","12.2.13-0ubuntu0.18.04.7","12.2.13-0ubuntu0.18.04.8"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.11.83+g8a15f484c2-lp152.2.15.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"ceph-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.11.83+g8a15f484c2-lp152.2.15.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"benji","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.0-1.2"}]}]}],"products":[{"vendor":"ceph","product":"ceph"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"linuxfoundation","product":"ceph"},{"vendor":"redhat","product":"ceph_storage"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1938031","tags":["x_transferred","Issue Tracking","Patch","Third Party Advisory","advisory","fix","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/362CEPPYF3YMJZBEJQUT3KDE2EHYYIYQ/","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5BPIAYTRCWAU4XWCDBK2THEFVXSC4XGK/","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JVWUKUUS5BCIFWRV3JCUQMAPJ4HIWSED/","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202105-39","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/10/msg00034.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-20288","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/362CEPPYF3YMJZBEJQUT3KDE2EHYYIYQ"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5BPIAYTRCWAU4XWCDBK2THEFVXSC4XGK"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JVWUKUUS5BCIFWRV3JCUQMAPJ4HIWSED"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/362CEPPYF3YMJZBEJQUT3KDE2EHYYIYQ"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5BPIAYTRCWAU4XWCDBK2THEFVXSC4XGK"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JVWUKUUS5BCIFWRV3JCUQMAPJ4HIWSED"},{"url":"https://github.com/advisories/GHSA-39jx-6759-44c6"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-20288","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-20288","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0207.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=28804","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2021/04/14/2","tags":["web","report"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1715","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:2445","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1766702","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1775096","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1826224","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1859181","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1878771","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1882086","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1882087","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1882089","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1882091","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1884463","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1892406","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1892408","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1896040","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1896461","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1896464","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1896465","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1900111","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1901330","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1902752","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1902753","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1903504","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1905431","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1906262","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1906305","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1906447","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1906627","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1909011","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1909760","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1909762","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1910151","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1917680","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1918650","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1919084","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1919471","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1920900","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1921798","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1922926","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1925503","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1925506","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1925646","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1926170","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1927869","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1928000","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1928785","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1930180","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1930264","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1933721","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1934092","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1935406","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1941678","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1942444","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1943391","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1944996","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1944999","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1945920","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1946263","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1946536","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1946987","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1947215","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1947673","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1947695","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1949391","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1949489","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1949490","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1950116","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1951386","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1952011","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1952466","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1952570","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1954748","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1954789","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1954819","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1955218","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1955782","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1958362","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1959254","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1959452","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1962077","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1963066","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1963914","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1963962","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1964144","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1964481","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1964835","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1964907","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1964995","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1966880","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1967341","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2445.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-27839","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-27839","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-27839","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3509","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3509","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3509","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-20288","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-20288","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2022:1394","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2068353","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2069491","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2071676","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1394.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211472-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1145463","tags":["report"]},{"url":"https://bugzilla.suse.com/1174466","tags":["report"]},{"url":"https://bugzilla.suse.com/1177200","tags":["report"]},{"url":"https://bugzilla.suse.com/1178016","tags":["report"]},{"url":"https://bugzilla.suse.com/1178216","tags":["report"]},{"url":"https://bugzilla.suse.com/1178235","tags":["report"]},{"url":"https://bugzilla.suse.com/1178657","tags":["report"]},{"url":"https://bugzilla.suse.com/1178837","tags":["report"]},{"url":"https://bugzilla.suse.com/1178860","tags":["report"]},{"url":"https://bugzilla.suse.com/1178905","tags":["report"]},{"url":"https://bugzilla.suse.com/1179997","tags":["report"]},{"url":"https://bugzilla.suse.com/1180118","tags":["report"]},{"url":"https://bugzilla.suse.com/1180594","tags":["report"]},{"url":"https://bugzilla.suse.com/1181183","tags":["report"]},{"url":"https://bugzilla.suse.com/1181378","tags":["report"]},{"url":"https://bugzilla.suse.com/1181665","tags":["report"]},{"url":"https://bugzilla.suse.com/1183074","tags":["report"]},{"url":"https://bugzilla.suse.com/1183487","tags":["report"]},{"url":"https://bugzilla.suse.com/1183600","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-27839","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20288","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211473-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211474-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1183899","tags":["report"]},{"url":"https://bugzilla.suse.com/1184231","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-20288","tags":["report"]},{"url":"https://docs.ceph.com/en/latest/security/CVE-2021-20288/#cve-2021-20288","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4998-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5128-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-25678","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-27781","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-27839","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3509","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3524","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3531","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/F27MV75T6ENOALLCPSWOQKELO26I3HCZ/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16889","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10736","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1759","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1760","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3509","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3524","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3531","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-20288","description":"An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse. An attacker who can request a global_id can exploit the ability of any user to request a global_id previously associated with another user, as ceph does not force the reuse of old keys to generate new ones. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.","status":"published","published":"2021-04-15T00:00:00Z","modified":"2024-08-03T17:37:22.742Z","cwes":["CWE-287"],"updated_at":"2026-11-02T14:32:55.564736Z"}],"euvd":[{"id":"EUVD-2021-7716","description":"An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse. An attacker who can request a global_id can exploit the ability of any user to request a global_id previously associated with another user, as ceph does not force the reuse of old keys to generate new ones. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.","status":"published","published":"2021-04-15T00:00:00Z","modified":"2024-08-03T17:37:22Z","updated_at":"2026-11-03T03:25:09.355483Z"}],"ghsa":[{"id":"GHSA-39jx-6759-44c6","title":"An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles...","description":"An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse. An attacker who can request a global_id can exploit the ability of any user to request a global_id previously associated with another user, as ceph does not force the reuse of old keys to generate new ones. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.","status":"published","published":"2022-05-24T17:47:40Z","modified":"2024-02-16T21:31:30Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:55:37.87337Z"}],"nvd":[{"id":"CVE-2021-20288","description":"An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse. An attacker who can request a global_id can exploit the ability of any user to request a global_id previously associated with another user, as ceph does not force the reuse of old keys to generate new ones. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.","status":"published","published":"2021-04-15T15:15:12.257Z","modified":"2026-06-17T03:33:36.687Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:06:52.03307Z"}],"osv":[{"id":"ALPINE-CVE-2021-20288","description":"An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse. An attacker who can request a global_id can exploit the ability of any user to request a global_id previously associated with another user, as ceph does not force the reuse of old keys to generate new ones. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.","status":"published","published":"2021-04-15T15:15:12.257Z","modified":"2026-11-03T06:32:46.316664051Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:16:46.202932Z"},{"id":"CVE-2021-20288","description":"An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse. An attacker who can request a global_id can exploit the ability of any user to request a global_id previously associated with another user, as ceph does not force the reuse of old keys to generate new ones. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.","status":"published","published":"2021-04-15T15:15:12.257Z","modified":"2026-10-24T10:30:25.527761377Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:18.004149Z"},{"id":"DEBIAN-CVE-2021-20288","description":"An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse. An attacker who can request a global_id can exploit the ability of any user to request a global_id previously associated with another user, as ceph does not force the reuse of old keys to generate new ones. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.","status":"published","published":"2021-04-15T15:15:12.257Z","modified":"2026-10-23T18:03:24.78333895Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:34.637046Z"},{"id":"OESA-2022-1715","title":"ceph security update","description":"Ceph is a massively scalable, open-source, distributed storage system that runs on commodity hardware and delivers object, block and file system storage.\r\n\r\nSecurity Fix(es):\r\n\r\nAn authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn\u0026apos;t sanitize other_keys, allowing key reuse. An attacker who can request a global_id can exploit the ability of any user to request a global_id previously associated with another user, as ceph does not force the reuse of old keys to generate new ones. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.(CVE-2021-20288)","status":"published","published":"2022-06-17T11:04:59Z","modified":"2026-08-18T01:16:00.83578969Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"RHSA-2021:2445","title":"Red Hat Security Advisory: Red Hat Ceph Storage 4.2 Security and Bug Fix Update","status":"published","published":"2024-09-16T05:49:49Z","modified":"2026-06-29T10:35:56Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2022:1394","title":"Red Hat Security Advisory: Red Hat Ceph Storage 3 Security and Bug Fix update","status":"published","published":"2024-09-13T22:49:05Z","modified":"2026-06-29T10:40:59Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"UBUNTU-CVE-2021-20288","description":"An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse. An attacker who can request a global_id can exploit the ability of any user to request a global_id previously associated with another user, as ceph does not force the reuse of old keys to generate new ones. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.","status":"published","published":"2021-04-15T15:15:00Z","modified":"2026-10-05T13:01:08.360809507Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:25.728622Z"},{"id":"BIT-ceph-2021-20288","description":"An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse. An attacker who can request a global_id can exploit the ability of any user to request a global_id previously associated with another user, as ceph does not force the reuse of old keys to generate new ones. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.","status":"published","published":"2026-03-20T09:05:43.098Z","modified":"2026-09-08T08:45:58.884941977Z","updated_at":"2026-11-02T15:28:28.70813Z"},{"id":"DLA-3629-1","title":"ceph - security update","status":"published","published":"2023-10-23T00:00:00Z","modified":"2026-03-09T01:20:33.777283Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"MGASA-2021-0207","title":"Updated ceph packages fix a security vulnerability","description":"An authentication flaw was found in ceph. When the monitor handles\nCEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys,\nallowing key reuse. An attacker who can request a global_id can exploit the\nability of any user to request a global_id previously associated with\nanother user, as ceph does not force the reuse of old keys to generate new\nones. The highest threat from this vulnerability is to data confidentiality\nand integrity as well as system availability (CVE-2021-20288).\n","status":"published","published":"2021-05-07T05:35:41Z","modified":"2026-04-16T04:41:29.386382148Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2021:0672-1","title":"Security update for ceph","description":"This update for ceph fixes the following issues:\n\n- ceph was updated to 15.2.11-83-g8a15f484c2:\n  * CVE-2021-20288: Fixed unauthorized global_id reuse (bsc#1183074).\n  * disk gets replaced with no rocksdb/wal (bsc#1184231).\n  * BlueStore handles huge(\u003e4GB) writes from RocksDB \n    to BlueFS poorly, potentially causing data corruption (bsc#1183899).\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2021-05-06T07:22:17Z","modified":"2026-02-04T02:55:46.942961Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2024:10649-1","title":"benji-0.15.0-1.2 on GA media","description":"These are all security issues fixed in the benji-0.15.0-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:04:18.240577Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:10676-1","title":"ceph-16.2.6.45+g8fda9838398-1.1 on GA media","description":"These are all security issues fixed in the ceph-16.2.6.45+g8fda9838398-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:26:40.49272Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2021:1472-1","title":"Security update for ceph, deepsea","description":"This update for ceph, deepsea fixes the following issues:\n\n- ceph was updated to 14.2.20-402-g6aa76c6815:\n    * CVE-2021-20288: Fixed unauthorized global_id reuse (bsc#1183074).\n    * CVE-2020-25678: Do not add sensitive information in Ceph log files (bsc#1178905).\n    * CVE-2020-27839: Use secure cookies to store JWT Token (bsc#1179997). \n    * mgr/dashboard: prometheus alerting: add some leeway for package drops and errors (bsc#1145463) \n    * mon: have 'mon stat' output json as well (bsc#1174466) \n    * rpm: ceph-mgr-dashboard recommends python3-saml on SUSE (bsc#1177200) \n    * mgr/dashboard: Display a warning message in Dashboard when debug mode is enabled (bsc#1178235) \n    * rgw: cls/user: set from_index for reset stats calls (bsc#1178837) \n    * mgr/dashboard: Disable TLS 1.0 and 1.1 (bsc#1178860)\n    * bluestore: provide a different name for fallback allocator (bsc#1180118) \n    * test/run-cli-tests: use cram from github (bsc#1181378) \n    * mgr/dashboard: fix 'Python2 Cookie module import fails on Python3' (bsc#1183487) \n    * common: make ms_bind_msgr2 default to 'false' (bsc#1180594) \n\n- deapsea was updated to 0.9.35\n    * osd: add method to zap simple osds (bsc#1178657, bsc#1178216)\n    * upgrade to cephadm: fix Drive Group generation (bsc#1181665)\n    * Rework config change detection to handle global.conf correctly (bsc#1181183)\n    * Use -i to pass credentials to `ceph dashboard` commands (bsc#1183600)\n","status":"published","published":"2021-05-04T06:56:39Z","modified":"2026-02-04T02:26:01.601395Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:1473-1","title":"Security update for ceph","description":"This update for ceph fixes the following issues:\n\n- ceph was updated to 14.2.20-402-g6aa76c6815:\n    * CVE-2021-20288: Fixed unauthorized global_id reuse (bsc#1183074).\n    * CVE-2020-25678: Do not add sensitive information in Ceph log files (bsc#1178905).\n    * CVE-2020-27839: Use secure cookies to store JWT Token (bsc#1179997). \n    * mgr/dashboard: prometheus alerting: add some leeway for package drops and errors (bsc#1145463) \n    * mon: have 'mon stat' output json as well (bsc#1174466) \n    * rpm: ceph-mgr-dashboard recommends python3-saml on SUSE (bsc#1177200) \n    * mgr/dashboard: Display a warning message in Dashboard when debug mode is enabled (bsc#1178235) \n    * rgw: cls/user: set from_index for reset stats calls (bsc#1178837) \n    * mgr/dashboard: Disable TLS 1.0 and 1.1 (bsc#1178860)\n    * bluestore: provide a different name for fallback allocator (bsc#1180118) \n    * test/run-cli-tests: use cram from github (bsc#1181378) \n    * mgr/dashboard: fix 'Python2 Cookie module import fails on Python3' (bsc#1183487) \n    * common: make ms_bind_msgr2 default to 'false' (bsc#1180594) \n","status":"published","published":"2021-05-04T06:58:05Z","modified":"2026-02-04T02:23:07.244902Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:1474-1","title":"Security update for ceph","description":"This update for ceph fixes the following issues:\n\n- ceph was updated to 15.2.11-83-g8a15f484c2:\n  * CVE-2021-20288: Fixed unauthorized global_id reuse (bsc#1183074).\n  * disk gets replaced with no rocksdb/wal (bsc#1184231).\n  * BlueStore handles huge(\u003e4GB) writes from RocksDB \n    to BlueFS poorly, potentially causing data corruption (bsc#1183899).\n","status":"published","published":"2021-05-04T06:59:10Z","modified":"2026-02-04T03:19:25.353646Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"USN-4998-1","title":"ceph vulnerabilities","description":"It was discovered that in some situations Ceph logged passwords from the\nmgr module in clear text. An attacker could use this to expose sensitive\ninformation. (CVE-2020-25678)\n\nGoutham Pacha Ravi, Jahson Babel, and John Garbutt discovered that user\ncredentials in Ceph could be manipulated in certain environments. An\nattacker could use this to gain unintended access. (CVE-2020-27781)\n\nIt was discovered that the Ceph dashboard was susceptible to a cross-site\nscripting attack. An attacker could use this to expose sensitive\ninformation or gain unintended access. (CVE-2020-27839)\n\nIt was discovered that Ceph contained an authentication flaw, leading to\nkey reuse. An attacker could use this to cause a denial of service or\npossibly impersonate another user. (CVE-2021-20288)\n\nSergey Bobrov discovered that the Ceph dashboard was susceptible to a\ncross-site scripting attack. An attacker could use this to expose sensitive\ninformation or gain unintended access. (CVE-2021-3509)\n\nSergey Bobrov discovered that Ceph's RadosGW (Ceph Object Gateway) allowed\nthe injection of HTTP headers in responses to CORS requests. An attacker\ncould use this to violate system integrity. (CVE-2021-3524)\n\nIt was discovered that Ceph's RadosGW (Ceph Object Gateway) did not\nproperly handle GET requests for swift URLs in some situations, leading to\nan application crash. An attacker could use this to cause a denial of\nservice. (CVE-2021-3531)\n","status":"published","published":"2021-06-25T02:38:50Z","modified":"2026-04-22T10:15:26.237909Z","updated_at":"2026-11-02T16:58:15.683829Z"},{"id":"USN-5128-1","title":"ceph vulnerabilities","description":"Goutham Pacha Ravi, Jahson Babel, and John Garbutt discovered that user\ncredentials in Ceph could be manipulated in certain environments. An\nattacker could use this to gain unintended access to resources. This issue\nonly affected Ubuntu 18.04 LTS. (CVE-2020-27781)\n\nIt was discovered that Ceph contained an authentication flaw, leading to\nkey reuse. An attacker could use this to cause a denial of service or\npossibly impersonate another user. This issue only affected Ubuntu 21.04.\n(CVE-2021-20288)\n\nSergey Bobrov discovered that the Ceph dashboard was susceptible to a\ncross-site scripting attack. An attacker could use this to expose sensitive\ninformation or gain unintended access. This issue only affected Ubuntu\n21.04. (CVE-2021-3509)\n\nSergey Bobrov discovered that Ceph's RadosGW (Ceph Object Gateway) allowed\nthe injection of HTTP headers in responses to CORS requests. An attacker\ncould use this to violate system integrity. (CVE-2021-3524)\n\nIt was discovered that Ceph's RadosGW (Ceph Object Gateway) did not\nproperly handle GET requests for swift URLs in some situations, leading to\nan application crash. An attacker could use this to cause a denial of\nservice. (CVE-2021-3531)\n","status":"published","published":"2021-11-01T22:40:54Z","modified":"2026-04-22T10:18:48.950597Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}