A vulnerability was found in how Ceph uses Pybind, which does not implement correct certificate checking. No SSL context is passed to the constructor imaplib.IMAP4_SSL or smtplib.SMTP_SSL. As a result, pybind does not check the server's X.509
certificate, instead accepting any certificate. This can allow an attacker to compromise mail server credentials or mail contents, via a Man In The Middle (MITM) attack, impacting confidentiality and availability.