CVE-2021-3979

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-3979
A key length flaw was found in Red Hat Ceph Storage. An attacker can exploit the fact that the key length is incorrectly passed in an encryption algorithm to create a non random key, which is weaker and can be exploited for loss of confidentiality and integrity on encrypted disks.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://access.redhat.com/security/cve/CVE-2021-3979 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2024788 Issue Tracking Vendor Advisory
https://github.com/ceph/ceph/commit/47c33179f9a15ae95cc1579a421be89378602656 Patch Third Party Advisory
https://github.com/ceph/ceph/pull/44765 Patch Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/10/msg00034.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BPOK44BESMIFW6BIOGCN452AKKOIIT6Q/ Mailing List
https://tracker.ceph.com/issues/54006 Issue Tracking Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:redhat:ceph_storage:3.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:ceph_storage:4.3:*:*:*:*:*:*:*
cpe:2.3:a:redhat:ceph_storage:5.1:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_storage:4.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_data_foundation:4.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openstack_platform:13.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:ceph_storage_for_ibm_z_systems:4.0:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
OR cpe:2.3:a:redhat:ceph_storage:4.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:ceph_storage:5.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:ceph_storage_for_power:4.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
OR cpe:2.3:a:redhat:ceph_storage:4.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:ceph_storage:5.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:ceph_storage_for_power:4.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
History

23 Oct 2023, 19:15

Type Values Removed Values Added
References
  • (MISC) https://lists.debian.org/debian-lts-announce/2023/10/msg00034.html -

11 Jul 2023, 20:21

Type Values Removed Values Added
References (MISC) https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BPOK44BESMIFW6BIOGCN452AKKOIIT6Q/ - (MISC) https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BPOK44BESMIFW6BIOGCN452AKKOIIT6Q/ - Mailing List
CWE CWE-327 CWE-287

12 Feb 2023, 23:42

Type Values Removed Values Added
References
  • {'url': 'https://access.redhat.com/errata/RHSA-2022:1174', 'name': 'https://access.redhat.com/errata/RHSA-2022:1174', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2022:1716', 'name': 'https://access.redhat.com/errata/RHSA-2022:1716', 'tags': [], 'refsource': 'MISC'}

02 Feb 2023, 21:21

Type Values Removed Values Added
References
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BPOK44BESMIFW6BIOGCN452AKKOIIT6Q/', 'name': 'FEDORA-2022-d832fd2f45', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'FEDORA'}
  • (MISC) https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BPOK44BESMIFW6BIOGCN452AKKOIIT6Q/ -
  • (MISC) https://access.redhat.com/errata/RHSA-2022:1174 -
  • (MISC) https://access.redhat.com/errata/RHSA-2022:1716 -

08 Dec 2022, 22:34

Type Values Removed Values Added
References (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BPOK44BESMIFW6BIOGCN452AKKOIIT6Q/ - (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BPOK44BESMIFW6BIOGCN452AKKOIIT6Q/ - Mailing List, Third Party Advisory
CPE cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*

14 Nov 2022, 15:15

Type Values Removed Values Added
References
  • (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BPOK44BESMIFW6BIOGCN452AKKOIIT6Q/ -

31 Aug 2022, 14:42

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5
First Time Fedoraproject
Redhat ceph Storage For Ibm Z Systems
Fedoraproject fedora
Redhat
Redhat openstack Platform
Redhat enterprise Linux
Redhat ceph Storage
Redhat openshift Data Foundation
Redhat openshift Container Storage
Redhat ceph Storage For Power
CWE CWE-327
CPE cpe:2.3:a:redhat:ceph_storage_for_power:4.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openstack_platform:13.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:ceph_storage:4.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:ceph_storage_for_ibm_z_systems:4.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:ceph_storage:3.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:ceph_storage:5.1:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_data_foundation:4.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:ceph_storage:4.3:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_storage:4.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
cpe:2.3:a:redhat:ceph_storage:5.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
References (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2024788 - (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2024788 - Issue Tracking, Vendor Advisory
References (MISC) https://access.redhat.com/security/cve/CVE-2021-3979 - (MISC) https://access.redhat.com/security/cve/CVE-2021-3979 - Vendor Advisory
References (MISC) https://github.com/ceph/ceph/pull/44765 - (MISC) https://github.com/ceph/ceph/pull/44765 - Patch, Third Party Advisory
References (MISC) https://github.com/ceph/ceph/commit/47c33179f9a15ae95cc1579a421be89378602656 - (MISC) https://github.com/ceph/ceph/commit/47c33179f9a15ae95cc1579a421be89378602656 - Patch, Third Party Advisory
References (MISC) https://tracker.ceph.com/issues/54006 - (MISC) https://tracker.ceph.com/issues/54006 - Issue Tracking, Vendor Advisory

25 Aug 2022, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2022-08-25 20:15

Updated : 2023-12-10 14:35

NVD link : CVE-2021-3979

Mitre link : CVE-2021-3979

CVE.ORG link : CVE-2021-3979

JSON object : View

Products Affected

redhat

  • enterprise_linux
  • ceph_storage
  • openstack_platform
  • openshift_container_storage
  • ceph_storage_for_ibm_z_systems
  • openshift_data_foundation
  • ceph_storage_for_power

fedoraproject

  • fedora
CWE
CWE-287

Improper Authentication

CWE-327

Use of a Broken or Risky Cryptographic Algorithm