A flaw was found in Red Hat Ceph Storage version 3 in the way the Ceph RADOS Gateway daemon handles S3 requests. An authenticated attacker can abuse this flaw by causing a remote denial of service by sending a specially crafted HTTP Content-Length header to the Ceph RADOS Gateway server.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade ceph-radosgwUpgrade libcephfs-develUpgrade ceph-mdsUpgrade cephmetrics-ansibleUpgrade librgw2Upgrade librbd-develUpgrade libradosstriper1Upgrade ceph-ansibleUpgrade ceph-commonUpgrade python-rgwUpgrade ceph-fuseUpgrade ceph-debuginfoUpgrade librgw-develUpgrade rbd-mirrorUpgrade python-cephfsUpgrade librados-develUpgrade libcephfs2Upgrade ceph-baseUpgrade ceph-selinux | Mar 2, 2020 | Dec 23, 2019 |
| Redhat_linux | — | Upgrade ceph-fuseUpgrade libcephfs2Upgrade librgw-develUpgrade ceph-debuginfoUpgrade rbd-mirrorUpgrade cephmetrics-ansibleUpgrade ceph-commonUpgrade python-cephfsUpgrade libcephfs-develUpgrade librados-develUpgrade ceph-radosgwUpgrade python-rgwUpgrade librbd-develUpgrade librgw2Upgrade ceph-ansibleUpgrade ceph-baseUpgrade libradosstriper1Upgrade ceph-selinuxUpgrade ceph-mds | Mar 2, 2020 | Dec 23, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub