A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway). The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made. Ceph versions 3.x and 4.x are vulnerable to this issue.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ceph16Upgrade ceph | Aug 22, 2024 | Jun 26, 2020 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jun 26, 2020 |
| Centos_linux | — | Upgrade ceph-debuginfoUpgrade nfs-ganesha-proxy-debuginfoUpgrade ceph-baseUpgrade libcephfs-develUpgrade libradosstriper1-debuginfoUpgrade nfs-ganesha-rados-grace-debuginfoUpgrade nfs-ganesha-vfsUpgrade librados-develUpgrade ceph-commonUpgrade nfs-ganesha-selinuxUpgrade librados-devel-debuginfoUpgrade python3-rbdUpgrade libcephfs2-debuginfoUpgrade python3-rgw-debuginfoUpgrade nfs-ganesha-rados-urls-debuginfoUpgrade nfs-ganesha-debugsourceUpgrade rbd-mirror-debuginfoUpgrade libradospp-develUpgrade ceph-grafana-dashboardsUpgrade python3-ceph-argparseUpgrade python3-rbd-debuginfoUpgrade rbd-nbd-debuginfoUpgrade ceph-base-debuginfoUpgrade librgw-develUpgrade ceph-mgr-debuginfoUpgrade nfs-ganesha-rgw-debuginfoUpgrade nfs-ganesha-cephUpgrade cockpit-ceph-installerUpgrade nfs-ganeshaUpgrade libcephfs2Upgrade ceph-debugsourceUpgrade python3-cephfs-debuginfoUpgrade python3-cephfsUpgrade rbd-nbdUpgrade ceph-radosgw-debuginfoUpgrade ceph-mdsUpgrade ceph-ansibleUpgrade ceph-mds-debuginfoUpgrade python3-radosUpgrade python-rgwUpgrade rbd-fuse-debuginfoUpgrade libradosstriper1Upgrade ceph-common-debuginfoUpgrade ceph-fuse-debuginfoUpgrade ceph-osd-debuginfoUpgrade nfs-ganesha-rados-graceUpgrade nfs-ganesha-debuginfoUpgrade nfs-ganesha-ceph-debuginfoUpgrade ceph-test-debuginfoUpgrade ceph-fuseUpgrade librgw2Upgrade rbd-mirrorUpgrade librbd-develUpgrade nfs-ganesha-vfs-debuginfoUpgrade nfs-ganesha-proxyUpgrade python-ceph-argparseUpgrade python3-rgwUpgrade ceph-mon-debuginfoUpgrade nfs-ganesha-rgwUpgrade librgw2-debuginfoUpgrade nfs-ganesha-rados-urlsUpgrade ceph-selinuxUpgrade python-cephfsUpgrade ceph-medicUpgrade python3-rados-debuginfoUpgrade ceph-radosgw | Aug 19, 2020 | Jun 26, 2020 |
| Debian | — | Upgrade ceph | Aug 12, 2021 | Jun 26, 2020 |
| Freebsd | — | Upgrade ceph14 | Aug 18, 2020 | Aug 16, 2020 |
| Gentoo Linux | — | Upgrade sys-cluster/ceph. | May 28, 2021 | Jun 26, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade python-rbdUpgrade librbd1Upgrade librados2Upgrade ceph-commonUpgrade python-rados | May 25, 2022 | Jun 26, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade ceph-commonUpgrade python-rbdUpgrade librbd1Upgrade python-radosUpgrade librados2 | Apr 26, 2022 | Jun 26, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python-rbdUpgrade librados2Upgrade cephUpgrade python-radosUpgrade librbd1 | Feb 2, 2021 | Jun 26, 2020 |
| Redhat_linux | — | Upgrade nfs-ganesha-rados-urlsUpgrade python3-cephfs-debuginfoUpgrade ceph-selinuxUpgrade libradosstriper1Upgrade ceph-osd-debuginfoUpgrade nfs-ganesha-rados-graceUpgrade ceph-mds-debuginfoUpgrade nfs-ganesha-rados-grace-debuginfoUpgrade ceph-radosgw-debuginfoUpgrade python-ceph-argparseUpgrade ceph-mon-debuginfoUpgrade nfs-ganesha-cephUpgrade python3-rbdUpgrade ceph-mgr-debuginfoUpgrade ceph-baseUpgrade nfs-ganesha-debugsourceUpgrade ceph-medicUpgrade rbd-nbd-debuginfoUpgrade cockpit-ceph-installerUpgrade nfs-ganesha-ceph-debuginfoUpgrade libradospp-develUpgrade python-cephfsUpgrade ceph-common-debuginfoUpgrade python3-rgwUpgrade rbd-mirror-debuginfoUpgrade nfs-ganesha-vfsUpgrade python3-rgw-debuginfoUpgrade ceph-base-debuginfoUpgrade ceph-test-debuginfoUpgrade nfs-ganesha-rgwUpgrade nfs-ganeshaUpgrade python3-rbd-debuginfoUpgrade libcephfs-develUpgrade librgw2-debuginfoUpgrade ceph-commonUpgrade librados-develUpgrade nfs-ganesha-debuginfoUpgrade nfs-ganesha-proxy-debuginfoUpgrade librgw-develUpgrade python3-ceph-argparseUpgrade ceph-radosgwUpgrade ceph-fuseUpgrade nfs-ganesha-vfs-debuginfoUpgrade libradosstriper1-debuginfoUpgrade python3-cephfsUpgrade nfs-ganesha-selinuxUpgrade rbd-fuse-debuginfoUpgrade ceph-grafana-dashboardsUpgrade librados-devel-debuginfoUpgrade ceph-debugsourceUpgrade ceph-fuse-debuginfoUpgrade ceph-debuginfoUpgrade nfs-ganesha-rgw-debuginfoUpgrade libcephfs2Upgrade python-rgwUpgrade python3-rados-debuginfoUpgrade rbd-nbdUpgrade nfs-ganesha-proxyUpgrade librbd-develUpgrade nfs-ganesha-rados-urls-debuginfoUpgrade libcephfs2-debuginfoUpgrade librgw2Upgrade ceph-mdsUpgrade python3-radosUpgrade ceph-ansibleUpgrade rbd-mirror | Aug 19, 2020 | Jun 26, 2020 |
| Suse | — | Upgrade ceph-monUpgrade rbd-mirrorUpgrade ceph-grafana-dashboardsUpgrade python3-radosUpgrade libcephfs-develUpgrade ceph-mgr-rookUpgrade librgw-develUpgrade ceph-commonUpgrade python-rbdUpgrade ceph-mgrUpgrade librados-develUpgrade librbd1Upgrade libcephfs2Upgrade ceph-mgr-sshUpgrade libradosstriper-develUpgrade ceph-baseUpgrade rbd-nbdUpgrade ceph-testUpgrade libradospp-develUpgrade ceph-mdsUpgrade librgw2Upgrade libradosstriper1Upgrade ceph-prometheus-alertsUpgrade ceph-radosgwUpgrade rados-objclass-develUpgrade ceph-dashboard-e2eUpgrade cephUpgrade ceph-osdUpgrade python3-rbdUpgrade librbd-develUpgrade python-cephfsUpgrade ceph-resource-agentsUpgrade ceph-mgr-dashboardUpgrade ceph-mgr-k8seventsUpgrade python-rgwUpgrade ceph-mgr-diskprediction-localUpgrade python-radosUpgrade python3-cephfsUpgrade ceph-fuseUpgrade python3-rgwUpgrade librados2Upgrade rbd-fuseUpgrade cephfs-shellUpgrade ceph-mgr-diskprediction-cloudUpgrade python3-ceph-argparse | Jun 26, 2020 | Jun 25, 2020 |
| Ubuntu | — | Upgrade ceph-baseUpgrade ceph-commonUpgrade ceph | Sep 23, 2020 | Jun 25, 2020 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub