A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in versions before 14.2.21. The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made. In addition, the prior bug fix for CVE-2020-10753 did not account for the use of \r as a header separator, thus a new flaw has been created.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade cephUpgrade ceph16 | Aug 22, 2024 | May 17, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | May 17, 2021 |
| Centos_linux | — | Upgrade rbd-mirror-debuginfoUpgrade ceph-mgr-debuginfoUpgrade python3-rgw-debuginfoUpgrade ceph-test-debuginfoUpgrade python3-cephfs-debuginfoUpgrade nfs-ganesha-cephUpgrade nfs-ganeshaUpgrade python3-ceph-commonUpgrade rbd-nbd-debuginfoUpgrade libcephfs2Upgrade nfs-ganesha-rados-graceUpgrade nfs-ganesha-rados-urlsUpgrade python3-rgwUpgrade ceph-base-debuginfoUpgrade cephfs-mirror-debuginfoUpgrade ceph-baseUpgrade ceph-iscsiUpgrade python-ceph-argparseUpgrade libradospp-develUpgrade ceph-osd-debuginfoUpgrade nfs-ganesha-vfsUpgrade nfs-ganesha-rados-grace-debuginfoUpgrade libntirpc-debuginfoUpgrade cephadmUpgrade cephadm-ansibleUpgrade python-rgwUpgrade ceph-common-debuginfoUpgrade libradosstriper1Upgrade cephfs-topUpgrade nfs-ganesha-rgwUpgrade python3-rbd-debuginfoUpgrade ceph-selinuxUpgrade ceph-debugsourceUpgrade ceph-mon-debuginfoUpgrade ceph-radosgw-debuginfoUpgrade nfs-ganesha-ceph-debuginfoUpgrade ceph-resource-agentsUpgrade ceph-mds-debuginfoUpgrade librbd-develUpgrade ceph-radosgwUpgrade python-cephfsUpgrade ceph-ansibleUpgrade rbd-mirrorUpgrade ceph-immutable-object-cache-debuginfoUpgrade ceph-mdsUpgrade python3-ceph-argparseUpgrade libradosstriper1-debuginfoUpgrade tcmu-runnerUpgrade librados-develUpgrade libntirpc-debugsourceUpgrade nfs-ganesha-rgw-debuginfoUpgrade librgw2Upgrade python3-rados-debuginfoUpgrade python3-cephfsUpgrade ceph-fuseUpgrade librgw2-debuginfoUpgrade cephfs-mirrorUpgrade libtcmuUpgrade rbd-nbdUpgrade librgw-develUpgrade nfs-ganesha-proxy-debuginfoUpgrade librados-devel-debuginfoUpgrade ceph-debuginfoUpgrade rbd-fuse-debuginfoUpgrade nfs-ganesha-selinuxUpgrade libcephfs2-debuginfoUpgrade libcephsqlite-debuginfoUpgrade ceph-fuse-debuginfoUpgrade nfs-ganesha-vfs-debuginfoUpgrade nfs-ganesha-debugsourceUpgrade libcephfs-develUpgrade python3-rbdUpgrade ceph-immutable-object-cacheUpgrade ceph-grafana-dashboardsUpgrade ceph-commonUpgrade nfs-ganesha-debuginfoUpgrade libntirpcUpgrade python3-radosUpgrade nfs-ganesha-rados-urls-debuginfoUpgrade nfs-ganesha-proxy | Apr 5, 2022 | May 17, 2021 |
| Debian | — | Upgrade ceph | Aug 12, 2021 | May 17, 2021 |
| Huawei Euleros 2_0_sp3 | — | Upgrade python-radosUpgrade ceph-commonUpgrade librbd1Upgrade python-rbdUpgrade librados2 | May 25, 2022 | May 17, 2021 |
| Huawei Euleros 2_0_sp5 | — | Upgrade python-radosUpgrade librbd1Upgrade librados2Upgrade python-rbdUpgrade ceph-common | Apr 26, 2022 | May 17, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python-radosUpgrade librados2Upgrade librbd1Upgrade python-rbd | Aug 10, 2021 | May 17, 2021 |
| Redhat_linux | — | Upgrade cephfs-topUpgrade python-rgwUpgrade librbd-develUpgrade ceph-selinuxUpgrade rbd-mirrorUpgrade ceph-radosgwUpgrade ceph-ansibleUpgrade cephadmUpgrade cephfs-mirror-debuginfoUpgrade rbd-nbdUpgrade ceph-fuse-debuginfoUpgrade libntirpcUpgrade ceph-base-debuginfoUpgrade nfs-ganesha-proxyUpgrade ceph-mon-debuginfoUpgrade nfs-ganeshaUpgrade ceph-resource-agentsUpgrade ceph-common-debuginfoUpgrade ceph-osd-debuginfoUpgrade nfs-ganesha-vfsUpgrade python3-rbd-debuginfoUpgrade python-ceph-argparseUpgrade ceph-mdsUpgrade ceph-fuseUpgrade ceph-iscsiUpgrade nfs-ganesha-debuginfoUpgrade python3-rgw-debuginfoUpgrade libradosstriper1Upgrade python-cephfsUpgrade nfs-ganesha-rados-urlsUpgrade nfs-ganesha-rados-urls-debuginfoUpgrade nfs-ganesha-cephUpgrade ceph-immutable-object-cacheUpgrade python3-radosUpgrade librgw2Upgrade python3-cephfsUpgrade ceph-mgr-debuginfoUpgrade nfs-ganesha-ceph-debuginfoUpgrade ceph-test-debuginfoUpgrade ceph-debuginfoUpgrade libntirpc-debuginfoUpgrade ceph-mds-debuginfoUpgrade nfs-ganesha-rados-graceUpgrade libradosstriper1-debuginfoUpgrade nfs-ganesha-debugsourceUpgrade cephfs-mirrorUpgrade ceph-debugsourceUpgrade rbd-mirror-debuginfoUpgrade ceph-grafana-dashboardsUpgrade libcephsqlite-debuginfoUpgrade libntirpc-debugsourceUpgrade nfs-ganesha-selinuxUpgrade nfs-ganesha-rgw-debuginfoUpgrade nfs-ganesha-proxy-debuginfoUpgrade tcmu-runnerUpgrade cephadm-ansibleUpgrade nfs-ganesha-vfs-debuginfoUpgrade python3-rgwUpgrade python3-cephfs-debuginfoUpgrade libcephfs2-debuginfoUpgrade python3-ceph-commonUpgrade ceph-immutable-object-cache-debuginfoUpgrade nfs-ganesha-rados-grace-debuginfoUpgrade libcephfs-develUpgrade python3-rados-debuginfoUpgrade libcephfs2Upgrade librgw2-debuginfoUpgrade ceph-baseUpgrade libradospp-develUpgrade ceph-commonUpgrade ceph-radosgw-debuginfoUpgrade rbd-fuse-debuginfoUpgrade rbd-nbd-debuginfoUpgrade librados-devel-debuginfoUpgrade librados-develUpgrade libtcmuUpgrade nfs-ganesha-rgwUpgrade python3-ceph-argparseUpgrade librgw-develUpgrade python3-rbd | Apr 5, 2022 | May 17, 2021 |
| Suse | — | Upgrade libcephfs2Upgrade python3-radosUpgrade ceph-commonUpgrade ceph-grafana-dashboardsUpgrade ceph-immutable-object-cacheUpgrade ceph-mgrUpgrade ceph-monUpgrade python3-rbdUpgrade rbd-nbdUpgrade ceph-baseUpgrade ceph-fuseUpgrade librados2Upgrade rbd-mirrorUpgrade ceph-mgr-rookUpgrade python3-ceph-commonUpgrade librbd1Upgrade librados-develUpgrade librgw-develUpgrade libcephfs-develUpgrade ceph-mgr-modules-coreUpgrade cephfs-shellUpgrade ceph-prometheus-alertsUpgrade ceph-mgr-k8seventsUpgrade ceph-mgr-dashboardUpgrade python3-cephfsUpgrade ceph-mgr-cephadmUpgrade ceph-mdsUpgrade ceph-radosgwUpgrade python3-ceph-argparseUpgrade ceph-mgr-diskprediction-localUpgrade ceph-testUpgrade cephUpgrade librbd-develUpgrade rbd-fuseUpgrade rados-objclass-develUpgrade ceph-mgr-diskprediction-cloudUpgrade ceph-osdUpgrade cephadmUpgrade libradospp-develUpgrade python3-rgwUpgrade librgw2 | Jun 3, 2021 | May 17, 2021 |
| Ubuntu | — | Upgrade ceph-mgr-diskprediction-localUpgrade ceph-mgr-modules-coreUpgrade ceph-mgr-k8seventsUpgrade cephUpgrade ceph-mgr-rookUpgrade ceph-mgrUpgrade radosgw (Ubuntu Pro)Upgrade ceph-mgr-cephadmUpgrade ceph-baseUpgrade ceph-mgr-diskprediction-cloudUpgrade radosgwUpgrade cephadmUpgrade ceph-mgr-dashboardUpgrade ceph (Ubuntu Pro)Upgrade ceph-commonUpgrade ceph-common (Ubuntu Pro) | Jun 25, 2021 | May 17, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub