Name: CVE-2019-19337: Improper Input Validation
Creator: Rapid7
Published: 2019-12-23T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2019-19337, CWE-20, CVSS 6.5, EPSS 0.0132

A flaw was found in Red Hat Ceph Storage version 3 in the way the Ceph RADOS Gateway daemon handles S3 requests. An authenticated attacker can abuse this flaw by causing a remote denial of service by sending a specially crafted HTTP Content-Length header to the Ceph RADOS Gateway server.

CVSS Details

CVSS 3.1 Base Score: 6.5
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Centos_linux	—	Upgrade python-cephfsUpgrade ceph-selinuxUpgrade librgw-develUpgrade rbd-mirrorUpgrade librados-develUpgrade ceph-baseUpgrade libcephfs2Upgrade ceph-debuginfoUpgrade ceph-radosgwUpgrade ceph-ansibleUpgrade ceph-commonUpgrade libcephfs-develUpgrade cephmetrics-ansibleUpgrade libradosstriper1Upgrade librgw2Upgrade librbd-develUpgrade ceph-fuseUpgrade python-rgwUpgrade ceph-mds	Mar 2, 2020	Dec 23, 2019
Redhat_linux	—	Upgrade libradosstriper1Upgrade librbd-develUpgrade librgw2Upgrade ceph-mdsUpgrade python-rgwUpgrade ceph-ansibleUpgrade ceph-baseUpgrade ceph-selinuxUpgrade rbd-mirrorUpgrade python-cephfsUpgrade librados-develUpgrade ceph-debuginfoUpgrade ceph-commonUpgrade ceph-radosgwUpgrade librgw-develUpgrade libcephfs2Upgrade libcephfs-develUpgrade cephmetrics-ansibleUpgrade ceph-fuse	Mar 2, 2020	Dec 23, 2019

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

MDR Buyer's Guide

Global Threat Landscape Report

CVSS Details

Covered by Rapid7

Prioritize with Active Threat Intelligence