Ceph (Python bindings, IMAP4_SSL/SMTP_SSL TLS clients): Ceph's Python code constructs imaplib.IMAP4_SSL and

Impact

Ceph's Python code constructs imaplib.IMAP4_SSL and smtplib.SMTP_SSL without passing an SSL context, so no X.509 validation happens and any certificate is accepted. An attacker positioned on the path between a Ceph manager node and the mail server it uses for alerting can present their own certificate, harvest the mail credentials Ceph authenticates with, and read or tamper with cluster alert traffic. For a cluster operator the practical loss is twofold: reusable SMTP/IMAP credentials (frequently shared with other infrastructure) and the ability to suppress or forge the alert channel that is supposed to tell you a storage node is failing or a tenant is misbehaving.

Who can reach it

Network, machine-in-the-middle between the Ceph mgr node and its configured mail server. No credentials and no user interaction needed — the attacker only needs a position on the path, which is realistic when alerting egresses over a shared or upstream-provider network.

What to do

Upgrade to a build carrying the fix (20.2.1, 19.2.4, 18.2.9 or later) and restart the mgr modules. Rotate the SMTP/IMAP credentials Ceph was configured with, since a MITM window means they may already be captured. Where possible route alert egress over a path you control rather than shared transit.

References