CVE-2020-1759 [Medium] | Security Vulnerability in Ceph Storage

A vulnerability was found in Red Hat Ceph Storage 4 and Red Hat Openshift Container Storage 4.2 where, A nonce reuse vulnerability was discovered in the secure mode of the messenger v2 protocol, which can allow an attacker to forge auth tags and potentially manipulate the data by leveraging the reuse of a nonce in a session. Messages encrypted using a reused nonce value are susceptible to serious confidentiality and integrity attacks.

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-06-15	0.41%	1.37%	+0.96%
2	2025-11-21	0.33%	0.41%	+0.08%
3	2025-11-18	—	0.33%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-06-15

0.41%

1.37%

+0.96%

2025-11-21

0.33%

0.41%

+0.08%

2025-11-18

—

0.33%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
6.4	3.1	MEDIUM	`CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N` Click to expand Attack vector (AV:A) Attacker has to be nearby on the network—same office, same link, that vibe—not the whole wide internet. Attack complexity (AC:H) Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work. Privileges required (PR:N) No account or special rights needed—anonymous or random user is enough. User interaction (UI:R) A real person has to do something—click, install, enable—otherwise it doesn’t land. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:H) Serious risk that confidential data gets exposed in a big way. Integrity (I:H) They could widely tamper with or forge data—trust in the data is badly hurt. Availability (A:N) Service keeps running; no real outage angle.	1.2	5.2	[email protected]
6.8	3.1	MEDIUM	`CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:H) Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work. Privileges required (PR:N) No account or special rights needed—anonymous or random user is enough. User interaction (UI:R) A real person has to do something—click, install, enable—otherwise it doesn’t land. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:H) Serious risk that confidential data gets exposed in a big way. Integrity (I:H) They could widely tamper with or forge data—trust in the data is badly hurt. Availability (A:N) Service keeps running; no real outage angle.	1.6	5.2	[email protected]
5.8	2.0	MEDIUM	`AV:N/AC:M/Au:N/C:P/I:P/A:N` Click to expand Access vector (AV:N) Can be exploited remotely over network reachability. Access complexity (AC:M) Exploitation needs some favorable conditions, but not exceptional ones. Authentication (AU:N) No authentication is required. Confidentiality impact (C:P) Partial confidentiality impact. Integrity impact (I:P) Partial integrity impact. Availability impact (A:N) No availability impact.	8.6	4.9	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

6.4

3.1

MEDIUM

CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N Click to expand

Attack vector (AV:A): Attacker has to be nearby on the network—same office, same link, that vibe—not the whole wide internet.
Attack complexity (AC:H): Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work.
Privileges required (PR:N): No account or special rights needed—anonymous or random user is enough.
User interaction (UI:R): A real person has to do something—click, install, enable—otherwise it doesn’t land.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:H): Serious risk that confidential data gets exposed in a big way.
Integrity (I:H): They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:N): Service keeps running; no real outage angle.

1.2

5.2

[email protected]

6.8

3.1

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N Click to expand

Attack vector (AV:N): Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:H): Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work.
Privileges required (PR:N): No account or special rights needed—anonymous or random user is enough.
User interaction (UI:R): A real person has to do something—click, install, enable—otherwise it doesn’t land.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:H): Serious risk that confidential data gets exposed in a big way.
Integrity (I:H): They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:N): Service keeps running; no real outage angle.

1.6

5.2

[email protected]

5.8

2.0

MEDIUM

AV:N/AC:M/Au:N/C:P/I:P/A:N Click to expand

Access vector (AV:N): Can be exploited remotely over network reachability.
Access complexity (AC:M): Exploitation needs some favorable conditions, but not exceptional ones.
Authentication (AU:N): No authentication is required.
Confidentiality impact (C:P): Partial confidentiality impact.
Integrity impact (I:P): Partial integrity impact.
Availability impact (A:N): No availability impact.

8.6

4.9

[email protected]

OS Trackers for CVE-2020-1759

vendor	priority	summary	link
`alpine`	medium	CVE-2020-1759: 2 source package rows (ceph, ceph16); 4 state rows across 3 repos (3.17-community, 3.18-community, edge-community); fixed 4, open 0.	https://security.alpinelinux.org/vuln/CVE-2020-1759
`debian`	not yet assigned	CVE-2020-1759 not yet assigned priority: Debian including 1 source packages (ceph), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5.	https://security-tracker.debian.org/tracker/CVE-2020-1759
`gentoo`	normal	CVE-2020-1759: 1 GLSA(s) (202105-39), 1 atom(s) (sys-cluster/ceph); latest impact normal.	https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2020-1759
`redhat`	medium	—	https://access.redhat.com/security/cve/CVE-2020-1759
`suse`	medium	CVE-2020-1759 severity moderate: SUSE including 329 source package names (1.1.1.0.1.5.157:ceph-14.2.5.389+gb0f23ac248-3.17.2, 1.1.1.0.1.5.157:ceph-base-14.2.5.389+gb0f23ac248-3.17.2, …), 670 product×package rows across 66 product lines (Container caasp/v4/hyperkube, Container ses/6/cephcsi/cephcsi, … (66 product lines)): Fixed 325, Known Not Affected 226, Will Not Fix 119.	https://www.suse.com/security/cve/CVE-2020-1759/
`ubuntu`	medium	CVE-2020-1759 medium priority: Ubuntu including 1 source packages (ceph), 6 status rows across 6 suites (bionic, eoan, focal, trusty, upstream, xenial): not-affected 4, ignored 1, released 1.	https://ubuntu.com/security/CVE-2020-1759

Affected software / configurations for CVE-2020-1759

Vendor	Product	Version	Raw CPE
redhat	ceph_storage	4.0	cpe:2.3:a:redhat:ceph_storage:4.0:::::::*
redhat	openshift	4.2	cpe:2.3:a:redhat:openshift:4.2:::::::*
redhat	openstack	15	cpe:2.3:a:redhat:openstack:15:::::::*
linuxfoundation	ceph	< 14.2.21	cpe:2.3:a:linuxfoundation:ceph::::::::
fedoraproject	fedora	31	cpe:2.3:o:fedoraproject:fedora:31:::::::*

References for CVE-2020-1759

URL	Tags
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1759	Issue Tracking Patch Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P3A2UFR5IUIEXJUCF64GQ5OVLCZGODXE/
https://security.gentoo.org/glsa/202105-39	Third Party Advisory

URL

CVE-2020-1759

Exploit prediction scoring system (EPSS) score for CVE-2020-1759

Common vulnerability scoring system (CVSS) metrics for CVE-2020-1759

Weakness enumeration for CVE-2020-1759

OS Trackers for CVE-2020-1759

Affected software / configurations for CVE-2020-1759

References for CVE-2020-1759