CVE-2021-3979 | CVE Tracker

Description

A key length flaw was found in Red Hat Ceph Storage. An attacker can exploit the fact that the key length is incorrectly passed in an encryption algorithm to create a non random key, which is weaker and can be exploited for loss of confidentiality and integrity on encrypted disks.

Scores

CVSS scores of CVE-2021-3979, by who scored it
Scored by	CVSS	Score	Vector
NVDNVD · Modified	3.1	Medium6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS (exploitation in 30 days): 0.60% · top 51% of all CVEs (6 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.5.

Weakness

CWE-327 - Use of a Broken or Risky Cryptographic Algorithm (opens in a new tab)All about CWE-327 and its CVEs
CWE-287 (opens in a new tab)All about CWE-287 and its CVEs

Affected products

ceph
- affected Not-Known

References (8)

https://bugzilla.redhat.com/show_bug.cgi?id=2024788 (opens in a new tab)x_transferred
https://access.redhat.com/security/cve/CVE-2021-3979 (opens in a new tab)x_transferred
https://tracker.ceph.com/issues/54006 (opens in a new tab)x_transferred
https://github.com/ceph/ceph/pull/44765 (opens in a new tab)x_transferred
https://github.com/ceph/ceph/commit/47c33179f9a15ae95cc1579a421be89378602656 (opens in a new tab)x_transferred
FEDORA-2022-d832fd2f45 (opens in a new tab)vendor-advisoryx_transferred
https://lists.debian.org/debian-lts-announce/2023/10/msg00034.html (opens in a new tab)x_transferred
https://lists.debian.org/debian-lts-announce/2025/09/msg00025.html (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2021-3979](https://trackcve.app/badge/CVE-2021-3979.svg)](https://trackcve.app/cve/CVE-2021-3979)

Record last updated 3 Nov 2025, 18:08 UTC.

A key length flaw was found in Red Hat Ceph Storage. An attacker can exploit the fact that the key length is incorrectly passed in an…