PT-2020-15040 · Red Hat+2 · Red Hat Openshift Container Storage+3

Marian Rehak · Published 2020-04-06 · Updated 2026-03-20 · CVE-2020-1759

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Red Hat Ceph Storage version 4 Red Hat Openshift Container Storage version 4.2

Description A nonce reuse issue was discovered in the secure mode of the messenger v2 protocol. This allows an attacker to forge auth tags and potentially manipulate data by reusing a nonce in a session. Messages encrypted with a reused nonce value are susceptible to serious confidentiality and integrity attacks.

Recommendations For Red Hat Ceph Storage version 4, update to a version that addresses the nonce reuse vulnerability in the messenger v2 protocol. For Red Hat Openshift Container Storage version 4.2, update to a version that addresses the nonce reuse vulnerability in the messenger v2 protocol. As a temporary workaround, consider restricting the use of the secure mode of the messenger v2 protocol until a patch is available.

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-323

CWE-330

Related Identifiers

ALT-PU-2020-1757

ALT-PU-2020-1769

ALT-PU-2020-2845

ALT-PU-2021-1830

ALT-PU-2021-2332

BIT-CEPH-2020-1759

CVE-2020-1759

OPENSUSE-SU-2020:0494-1

OPENSUSE-SU-2020_0494-1

OPENSUSE-SU-2024:10676-1

SUSE-SU-2020:0930-1

SUSE-SU-2020_0930-1

Affected Products

Alt Linux

Red Hat Ceph Storage

Red Hat Openshift Container Storage

Suse

References · 21

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1759 · Vendor Advisory
• https://security.gentoo.org/glsa/202105-39 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-1759 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P3A2UFR5IUIEXJUCF64GQ5OVLCZGODXE · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:0930-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:0494-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-1759 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-1759 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1759 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-1759 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-ceph-2020-1759 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-1759 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-1759 · Security Note
• https://bugzilla.suse.com/1166403 · Note
• https://suse.com/support/update/announcement/2020/suse-su-20200930-1 · Note