A flaw was found in the way the Ceph RGW Beast front-end handles unexpected disconnects. An authenticated attacker can abuse this flaw by making multiple disconnect attempts resulting in a permanent leak of a socket connection by radosgw. This flaw could lead to a denial of service condition by pile up of CLOSE_WAIT sockets, eventually leading to the exhaustion of available resources, preventing legitimate users from connecting to the system.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade cephUpgrade ceph16 | Aug 22, 2024 | Feb 7, 2020 |
| Debian | — | Upgrade ceph | Oct 25, 2023 | Feb 7, 2020 |
| Suse | — | Upgrade python3-cephfsUpgrade ceph-monUpgrade librbd1Upgrade python3-radosUpgrade cephUpgrade ceph-mgr-sshUpgrade ceph-commonUpgrade ceph-mdsUpgrade ceph-testUpgrade rbd-mirrorUpgrade rados-objclass-develUpgrade python3-rbdUpgrade cephfs-shellUpgrade rbd-fuseUpgrade ceph-fuseUpgrade rbd-nbdUpgrade libcephfs-develUpgrade python3-ceph-argparseUpgrade librados-develUpgrade ceph-mgr-k8seventsUpgrade ceph-resource-agentsUpgrade ceph-mgr-diskprediction-localUpgrade libcephfs2Upgrade ceph-mgrUpgrade ceph-baseUpgrade ceph-mgr-diskprediction-cloudUpgrade librgw-develUpgrade libradosstriper1Upgrade librados2Upgrade ceph-radosgwUpgrade ceph-mgr-rookUpgrade ceph-prometheus-alertsUpgrade libradospp-develUpgrade python3-rgwUpgrade ceph-osdUpgrade librbd-develUpgrade libradosstriper-develUpgrade ceph-mgr-dashboardUpgrade ceph-grafana-dashboardsUpgrade librgw2Upgrade ceph-dashboard-e2e | Feb 9, 2020 | Feb 7, 2020 |
| Ubuntu | — | Upgrade ceph-commonUpgrade ceph-baseUpgrade ceph | Mar 18, 2020 | Feb 7, 2020 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub