CVE-2020-1759 Weak cryptography in ceph

Medium 6.4 Published 13 Apr 2020 Updated 4 Aug 2024

Nonce reuse in Ceph's secure messenger protocol allows attackers to forge authentication tags and manipulate encrypted data, compromising integrity and confidentiality.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2020-1759?

CVE-2020-1759 is a medium-severity vulnerability in Fedoraproject Fedora, published on 13 Apr 2020. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

A vulnerability was found in Red Hat Ceph Storage 4 and Red Hat Openshift Container Storage 4.2 where, A nonce reuse vulnerability was discovered in the secure mode of the messenger v2 protocol, which can allow an attacker to forge auth tags and potentially manipulate the data by leveraging the reuse of a nonce in a session. Messages encrypted using a reused nonce value are susceptible to serious confidentiality and integrity attacks.

Weakness: CWE-330, CWE-323

Which versions are affected by CVE-2020-1759?

1 open source package ship an affected version, including ceph. It affects 5 products.

Package	Affected	Fixed in
`ceph` Bitnami	All versions	`14.2.21`

Linux distribution packages (39)

`ceph` Red Hat:ceph_storage:4::el7	All versions	`2:14.2.8-111.el7cp`
`ceph-ansible` Red Hat:ceph_storage:4::el7	All versions	`0:4.0.31-1.el7cp`
`ceph-base` Red Hat:ceph_storage:4::el7	All versions	`2:14.2.8-111.el7cp`
`ceph-common` Red Hat:ceph_storage:4::el7	All versions	`2:14.2.8-111.el7cp`
`ceph-debuginfo` Red Hat:ceph_storage:4::el7	All versions	`2:14.2.8-111.el7cp`
`ceph-fuse` Red Hat:ceph_storage:4::el7	All versions	`2:14.2.8-111.el7cp`
`ceph-grafana-dashboards` Red Hat:ceph_storage:4::el7	All versions	`2:14.2.8-111.el7cp`
`ceph-mds` Red Hat:ceph_storage:4::el7	All versions	`2:14.2.8-111.el7cp`
`ceph-mgr` Red Hat:ceph_storage:4::el7	All versions	`2:14.2.8-111.el7cp`
`ceph-mgr-dashboard` Red Hat:ceph_storage:4::el7	All versions	`2:14.2.8-111.el7cp`
`ceph-mgr-diskprediction-local` Red Hat:ceph_storage:4::el7	All versions	`2:14.2.8-111.el7cp`
`ceph-mgr-k8sevents` Red Hat:ceph_storage:4::el7	All versions	`2:14.2.8-111.el7cp`
`ceph-mgr-rook` Red Hat:ceph_storage:4::el7	All versions	`2:14.2.8-111.el7cp`
`ceph-mon` Red Hat:ceph_storage:4::el7	All versions	`2:14.2.8-111.el7cp`
`ceph-osd` Red Hat:ceph_storage:4::el7	All versions	`2:14.2.8-111.el7cp`
`ceph-radosgw` Red Hat:ceph_storage:4::el7	All versions	`2:14.2.8-111.el7cp`
`ceph-selinux` Red Hat:ceph_storage:4::el7	All versions	`2:14.2.8-111.el7cp`
`ceph-test` Red Hat:ceph_storage:4::el7	All versions	`2:14.2.8-111.el7cp`
`libcephfs-devel` Red Hat:ceph_storage:4::el7	All versions	`2:14.2.8-111.el7cp`
`libcephfs2` Red Hat:ceph_storage:4::el7	All versions	`2:14.2.8-111.el7cp`
`librados-devel` Red Hat:ceph_storage:4::el7	All versions	`2:14.2.8-111.el7cp`
`librados2` Red Hat:ceph_storage:4::el7	All versions	`2:14.2.8-111.el7cp`
`libradospp-devel` Red Hat:ceph_storage:4::el7	All versions	`2:14.2.8-111.el7cp`
`libradosstriper1` Red Hat:ceph_storage:4::el7	All versions	`2:14.2.8-111.el7cp`
`librbd-devel` Red Hat:ceph_storage:4::el7	All versions	`2:14.2.8-111.el7cp`
`librbd1` Red Hat:ceph_storage:4::el7	All versions	`2:14.2.8-111.el7cp`
`librgw-devel` Red Hat:ceph_storage:4::el7	All versions	`2:14.2.8-111.el7cp`
`librgw2` Red Hat:ceph_storage:4::el7	All versions	`2:14.2.8-111.el7cp`
`python-ceph-argparse` Red Hat:ceph_storage:4::el7	All versions	`2:14.2.8-111.el7cp`
`python-cephfs` Red Hat:ceph_storage:4::el7	All versions	`2:14.2.8-111.el7cp`
`python-rados` Red Hat:ceph_storage:4::el7	All versions	`2:14.2.8-111.el7cp`
`python-rbd` Red Hat:ceph_storage:4::el7	All versions	`2:14.2.8-111.el7cp`
`python-rgw` Red Hat:ceph_storage:4::el7	All versions	`2:14.2.8-111.el7cp`
`rbd-mirror` Red Hat:ceph_storage:4::el7	All versions	`2:14.2.8-111.el7cp`
`rbd-nbd` Red Hat:ceph_storage:4::el7	All versions	`2:14.2.8-111.el7cp`
`ceph` Red Hat:ceph_storage:4::el8	All versions	`2:14.2.8-111.el8cp`
`ceph-ansible` Red Hat:ceph_storage:4::el8	All versions	`0:4.0.31-1.el8cp`
`ceph-base` Red Hat:ceph_storage:4::el8	All versions	`2:14.2.8-111.el8cp`
`ceph-base-debuginfo` Red Hat:ceph_storage:4::el8	All versions	`2:14.2.8-111.el8cp`

Products include Fedoraproject Fedora, Linuxfoundation Ceph, Redhat Ceph Storage, Redhat Openshift, Redhat Openstack.

How do I fix CVE-2020-1759?

Upgrade ceph to 14.2.21 or later.

Is CVE-2020-1759 being exploited?

There is no known exploitation of CVE-2020-1759 in the wild and no public exploit code.

All Fedoraproject Fedora vulnerabilities

Sources

Also known as BIT-ceph-2020-1759, DEBIAN-CVE-2020-1759, GHSA-hcpq-vw4g-3vmh, RHBA-2020:4144.