What’s Vulnerable › Vulnerabilities
CVE-2020-1759
- Severity: medium (CVSS 6.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.6% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2020-04-13 · updated 2026-06-17
- Weakness: CWE-323
Description
A vulnerability was found in Red Hat Ceph Storage 4 and Red Hat Openshift Container Storage 4.2 where, A nonce reuse vulnerability was discovered in the secure mode of the messenger v2 protocol, which can allow an attacker to forge auth tags and potentially manipulate the data by leveraging the reuse of a nonce in a session. Messages encrypted using a reused nonce value are susceptible to serious confidentiality and integrity attacks.
Affected products
- Fedoraproject Fedora: 31
- [UNKNOWN] ceph: before 14.2.21 — fixed in 14.2.21
- Red Hat Ceph Storage: 4.0
- Openshift: 4.2
- OpenStack: 15
How to fix
Upgrade to a fixed version: [UNKNOWN] ceph 14.2.21. Check the vendor advisory for mitigations.
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1759
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P3A2UFR5IUIEXJUCF64GQ5OVLCZGODXE/
- https://security.gentoo.org/glsa/202105-39
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1759
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P3A2UFR5IUIEXJUCF64GQ5OVLCZGODXE/
- https://security.gentoo.org/glsa/202105-39
Get alerted when CVE-2020-1759 or the next vulnerability affects your stack