https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2021-3979 "Hi all, The key length for encrypted devices created using ceph-volume is incorrect. This is due to a bug in ceph_volume/util/encryption.py, where upon writing a key using osd_dmcrypt_key_size it does not pass the key size to the format and open operations following. The default key is then applied in cryptsetup. All versions since Luminous are assumed affected." Doesn't seem there's any patch at URL and don't see any report upstream.
Possible patch (seems unupstreamed): https://www.openwall.com/lists/oss-security/2022/01/11/5 Might cause data corruption, though: https://www.openwall.com/lists/oss-security/2022/01/12/1
https://security-tracker.debian.org/tracker/CVE-2021-3979 https://tracker.ceph.com/issues/54006 ceph & debian said it had been fixed, the affected versions are not in tree now, so we can close this?
