In Ceph before 12.2.3 and 13.x through 13.0.1, the rgw_civetweb.cc RGWCivetWeb::init_env function in radosgw doesn't handle malformed HTTP headers properly, allowing for denial of service.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade ceph-commonUpgrade librgw-develUpgrade ceph-mdsUpgrade ceph-baseUpgrade libcephfs2Upgrade librgw2Upgrade librados-develUpgrade ceph-selinuxUpgrade python-cephfsUpgrade python-rgwUpgrade rbd-mirrorUpgrade libradosstriper1Upgrade librbd-develUpgrade ceph-debuginfoUpgrade ceph-radosgwUpgrade ceph-fuseUpgrade libcephfs-devel | Mar 2, 2020 | Mar 19, 2018 |
| Redhat_linux | — | Upgrade libradosstriper1Upgrade librbd-develUpgrade ceph-selinuxUpgrade python-cephfsUpgrade libcephfs-develUpgrade rbd-mirrorUpgrade ceph-radosgwUpgrade python-rgwUpgrade ceph-commonUpgrade ceph-fuseUpgrade ceph-debuginfoUpgrade libcephfs2Upgrade ceph-mdsUpgrade librgw-develUpgrade librados-develUpgrade librgw2Upgrade ceph-base | Mar 2, 2020 | Mar 19, 2018 |
| Suse | — | Upgrade librbd-develUpgrade libcephfs-develUpgrade python-radosUpgrade librbd1Upgrade python-rgwUpgrade libradosstriper1Upgrade ceph-commonUpgrade librados2Upgrade python-rbdUpgrade librgw2Upgrade libcephfs2Upgrade librados-develUpgrade python-cephfs | May 31, 2018 | Mar 19, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 19, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub