A flaw was found in the way the Ceph RGW Beast front-end handles unexpected disconnects. An authenticated attacker can abuse this flaw by making multiple disconnect attempts resulting in a permanent leak of a socket connection by radosgw. This flaw could lead to a denial of service condition by pile up of CLOSE_WAIT sockets, eventually leading to the exhaustion of available resources, preventing legitimate users from connecting to the system.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade cephUpgrade ceph16 | Aug 22, 2024 | Feb 7, 2020 |
| Debian | — | Upgrade ceph | Oct 25, 2023 | Feb 7, 2020 |
| Suse | — | Upgrade rados-objclass-develUpgrade python3-radosUpgrade librbd1Upgrade python3-rbdUpgrade ceph-mgr-sshUpgrade rbd-mirrorUpgrade libcephfs-develUpgrade rbd-nbdUpgrade ceph-commonUpgrade python3-ceph-argparseUpgrade rbd-fuseUpgrade python3-cephfsUpgrade ceph-monUpgrade cephUpgrade cephfs-shellUpgrade ceph-testUpgrade librados-develUpgrade ceph-mdsUpgrade ceph-fuseUpgrade ceph-mgrUpgrade ceph-baseUpgrade libradospp-develUpgrade librgw-develUpgrade python3-rgwUpgrade ceph-mgr-diskprediction-cloudUpgrade ceph-mgr-k8seventsUpgrade libradosstriper-develUpgrade librbd-develUpgrade ceph-prometheus-alertsUpgrade ceph-grafana-dashboardsUpgrade ceph-resource-agentsUpgrade ceph-mgr-diskprediction-localUpgrade ceph-dashboard-e2eUpgrade ceph-osdUpgrade libcephfs2Upgrade ceph-mgr-dashboardUpgrade librgw2Upgrade librados2Upgrade ceph-mgr-rookUpgrade ceph-radosgwUpgrade libradosstriper1 | Feb 9, 2020 | Feb 7, 2020 |
| Ubuntu | — | Upgrade ceph-baseUpgrade ceph-commonUpgrade ceph | Mar 18, 2020 | Feb 7, 2020 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub