CVE-2021-3979 Weak cryptography in ceph
Attackers can exploit weak encryption keys in Ceph Storage to compromise the confidentiality and integrity of encrypted disks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-3979?
CVE-2021-3979 is a medium-severity vulnerability in Fedoraproject Fedora, published on 25 Aug 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A key length flaw was found in Red Hat Ceph Storage. An attacker can exploit the fact that the key length is incorrectly passed in an encryption algorithm to create a non random key, which is weaker and can be exploited for loss of confidentiality and integrity on encrypted disks.
Which versions are affected by CVE-2021-3979?
It affects 7 products.
Linux distribution packages (16)
ceph SUSE:Enterprise Storage 7.1 | All versions | 16.2.9.536+g41a9f9a5573-150300.3.3.1 |
ceph SUSE:Linux Enterprise Micro 5.1 | All versions | 16.2.9.536+g41a9f9a5573-150300.6.3.1 |
fmt SUSE:Linux Enterprise Micro 5.1 | All versions | 8.0.1-150300.7.5.1 |
ceph SUSE:Linux Enterprise Micro 5.2 | All versions | 16.2.9.536+g41a9f9a5573-150300.6.3.1 |
fmt SUSE:Linux Enterprise Micro 5.2 | All versions | 8.0.1-150300.7.5.1 |
ceph SUSE:Linux Enterprise Module for Basesystem 15 SP3 | All versions | 16.2.9.536+g41a9f9a5573-150300.6.3.1 |
fmt SUSE:Linux Enterprise Module for Basesystem 15 SP3 | All versions | 8.0.1-150300.7.5.1 |
ceph SUSE:Linux Enterprise Module for Basesystem 15 SP4 | All versions | 16.2.9.536+g41a9f9a5573-150400.3.3.1 |
ceph openSUSE:Leap 15.3 | All versions | 16.2.9.536+g41a9f9a5573-150300.6.3.1 |
ceph-test openSUSE:Leap 15.3 | All versions | 16.2.9.536+g41a9f9a5573-150300.6.3.1 |
fmt openSUSE:Leap 15.3 | All versions | 8.0.1-150300.7.5.1 |
ceph openSUSE:Leap 15.4 | All versions | 16.2.9.536+g41a9f9a5573-150400.3.3.1 |
ceph-test openSUSE:Leap 15.4 | All versions | 16.2.9.536+g41a9f9a5573-150400.3.3.1 |
ceph openSUSE:Leap Micro 5.2 | All versions | 16.2.9.536+g41a9f9a5573-150300.6.3.1 |
fmt openSUSE:Leap Micro 5.2 | All versions | 8.0.1-150300.7.5.1 |
ceph openSUSE:Tumbleweed | All versions | 16.2.9.536+g41a9f9a5573-1.1 |
Products include Fedoraproject Fedora, Redhat Ceph Storage, Redhat Ceph Storage for Ibm Z Systems, Redhat Ceph Storage for Power, Redhat Openshift Container Storage, Redhat Openshift Data Foundation and 1 more.
How do I fix CVE-2021-3979?
Apply the vendor's patch.
Is CVE-2021-3979 being exploited?
There is no known exploitation of CVE-2021-3979 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as DEBIAN-CVE-2021-3979, GHSA-23g5-cwwr-8xhw, MGASA-2022-0138, OESA-2022-1528, SUSE-SU-2022:2817-1, SUSE-SU-2022:2818-1 and 3 more.