A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in versions before 14.2.21. The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made. In addition, the prior bug fix for CVE-2020-10753 did not account for the use of \r as a header separator, thus a new flaw has been created.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ceph16Upgrade ceph | Aug 22, 2024 | May 17, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | May 17, 2021 |
| Centos_linux | — | Upgrade nfs-ganesha-rados-urlsUpgrade ceph-radosgw-debuginfoUpgrade ceph-resource-agentsUpgrade ceph-iscsiUpgrade cephfs-topUpgrade ceph-debugsourceUpgrade libradospp-develUpgrade nfs-ganesha-rados-grace-debuginfoUpgrade nfs-ganesha-vfsUpgrade python-ceph-argparseUpgrade ceph-common-debuginfoUpgrade nfs-ganesha-ceph-debuginfoUpgrade rbd-mirror-debuginfoUpgrade cephadm-ansibleUpgrade nfs-ganesha-cephUpgrade python-rgwUpgrade ceph-test-debuginfoUpgrade nfs-ganeshaUpgrade ceph-mgr-debuginfoUpgrade python3-cephfs-debuginfoUpgrade python3-rgw-debuginfoUpgrade ceph-mds-debuginfoUpgrade libcephfs2Upgrade nfs-ganesha-rados-graceUpgrade cephadmUpgrade ceph-base-debuginfoUpgrade ceph-mon-debuginfoUpgrade python3-ceph-commonUpgrade libradosstriper1Upgrade rbd-nbd-debuginfoUpgrade python3-rbd-debuginfoUpgrade nfs-ganesha-rgwUpgrade cephfs-mirror-debuginfoUpgrade libntirpc-debuginfoUpgrade ceph-selinuxUpgrade python3-rgwUpgrade ceph-osd-debuginfoUpgrade ceph-baseUpgrade ceph-immutable-object-cacheUpgrade nfs-ganesha-vfs-debuginfoUpgrade librados-devel-debuginfoUpgrade rbd-mirrorUpgrade ceph-grafana-dashboardsUpgrade nfs-ganesha-debugsourceUpgrade nfs-ganesha-rados-urls-debuginfoUpgrade libntirpcUpgrade cephfs-mirrorUpgrade ceph-fuseUpgrade librgw2-debuginfoUpgrade libcephsqlite-debuginfoUpgrade ceph-commonUpgrade ceph-ansibleUpgrade python3-rbdUpgrade nfs-ganesha-debuginfoUpgrade libcephfs-develUpgrade ceph-immutable-object-cache-debuginfoUpgrade python3-cephfsUpgrade nfs-ganesha-rgw-debuginfoUpgrade librgw2Upgrade python3-rados-debuginfoUpgrade libtcmuUpgrade rbd-nbdUpgrade librgw-develUpgrade ceph-radosgwUpgrade ceph-fuse-debuginfoUpgrade tcmu-runnerUpgrade librados-develUpgrade libntirpc-debugsourceUpgrade ceph-mdsUpgrade python3-ceph-argparseUpgrade librbd-develUpgrade libradosstriper1-debuginfoUpgrade nfs-ganesha-proxy-debuginfoUpgrade ceph-debuginfoUpgrade rbd-fuse-debuginfoUpgrade nfs-ganesha-selinuxUpgrade libcephfs2-debuginfoUpgrade python3-radosUpgrade python-cephfsUpgrade nfs-ganesha-proxy | Apr 5, 2022 | May 17, 2021 |
| Debian | — | Upgrade ceph | Aug 12, 2021 | May 17, 2021 |
| Huawei Euleros 2_0_sp3 | — | Upgrade python-radosUpgrade python-rbdUpgrade librbd1Upgrade ceph-commonUpgrade librados2 | May 25, 2022 | May 17, 2021 |
| Huawei Euleros 2_0_sp5 | — | Upgrade python-radosUpgrade ceph-commonUpgrade librados2Upgrade python-rbdUpgrade librbd1 | Apr 26, 2022 | May 17, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python-radosUpgrade librados2Upgrade python-rbdUpgrade librbd1 | Aug 10, 2021 | May 17, 2021 |
| Redhat_linux | — | Upgrade python3-cephfs-debuginfoUpgrade tcmu-runnerUpgrade cephadm-ansibleUpgrade ceph-commonUpgrade libcephfs-develUpgrade ceph-immutable-object-cache-debuginfoUpgrade libcephfs2Upgrade cephfs-mirrorUpgrade nfs-ganesha-rados-grace-debuginfoUpgrade librgw2-debuginfoUpgrade libradospp-develUpgrade librgw-develUpgrade rbd-mirror-debuginfoUpgrade python3-rados-debuginfoUpgrade ceph-debugsourceUpgrade ceph-baseUpgrade python3-rgwUpgrade python3-rbdUpgrade libntirpc-debugsourceUpgrade libcephfs2-debuginfoUpgrade nfs-ganesha-rgwUpgrade librados-devel-debuginfoUpgrade ceph-radosgw-debuginfoUpgrade libtcmuUpgrade nfs-ganesha-selinuxUpgrade rbd-fuse-debuginfoUpgrade nfs-ganesha-proxy-debuginfoUpgrade rbd-nbd-debuginfoUpgrade librados-develUpgrade nfs-ganesha-rgw-debuginfoUpgrade ceph-grafana-dashboardsUpgrade libcephsqlite-debuginfoUpgrade python3-ceph-commonUpgrade python3-ceph-argparseUpgrade nfs-ganesha-vfs-debuginfoUpgrade ceph-fuseUpgrade libntirpc-debuginfoUpgrade python3-cephfsUpgrade ceph-base-debuginfoUpgrade ceph-test-debuginfoUpgrade ceph-debuginfoUpgrade libradosstriper1Upgrade nfs-ganesha-ceph-debuginfoUpgrade ceph-immutable-object-cacheUpgrade ceph-resource-agentsUpgrade python-ceph-argparseUpgrade python3-rgw-debuginfoUpgrade ceph-osd-debuginfoUpgrade ceph-common-debuginfoUpgrade ceph-mds-debuginfoUpgrade nfs-ganesha-vfsUpgrade librbd-develUpgrade python3-radosUpgrade nfs-ganesha-cephUpgrade python-cephfsUpgrade librgw2Upgrade rbd-nbdUpgrade cephfs-mirror-debuginfoUpgrade cephfs-topUpgrade nfs-ganeshaUpgrade ceph-mgr-debuginfoUpgrade ceph-mdsUpgrade libradosstriper1-debuginfoUpgrade nfs-ganesha-rados-graceUpgrade nfs-ganesha-debugsourceUpgrade libntirpcUpgrade ceph-iscsiUpgrade ceph-mon-debuginfoUpgrade nfs-ganesha-proxyUpgrade nfs-ganesha-rados-urlsUpgrade python3-rbd-debuginfoUpgrade ceph-ansibleUpgrade nfs-ganesha-debuginfoUpgrade ceph-selinuxUpgrade python-rgwUpgrade cephadmUpgrade ceph-radosgwUpgrade rbd-mirrorUpgrade ceph-fuse-debuginfoUpgrade nfs-ganesha-rados-urls-debuginfo | Apr 5, 2022 | May 17, 2021 |
| Suse | — | Upgrade python3-ceph-argparseUpgrade ceph-mgr-diskprediction-localUpgrade ceph-mgr-modules-coreUpgrade cephUpgrade librbd-develUpgrade rados-objclass-develUpgrade ceph-testUpgrade libradospp-develUpgrade librgw2Upgrade python3-rgwUpgrade ceph-osdUpgrade ceph-mgr-dashboardUpgrade ceph-mgr-cephadmUpgrade ceph-mdsUpgrade rbd-fuseUpgrade ceph-mgr-diskprediction-cloudUpgrade ceph-mgr-k8seventsUpgrade cephadmUpgrade cephfs-shellUpgrade ceph-radosgwUpgrade ceph-prometheus-alertsUpgrade python3-cephfsUpgrade ceph-baseUpgrade ceph-grafana-dashboardsUpgrade libcephfs2Upgrade python3-radosUpgrade ceph-mgrUpgrade rbd-mirrorUpgrade librgw-develUpgrade ceph-monUpgrade librbd1Upgrade python3-ceph-commonUpgrade ceph-fuseUpgrade python3-rbdUpgrade librados2Upgrade libcephfs-develUpgrade ceph-mgr-rookUpgrade librados-develUpgrade rbd-nbdUpgrade ceph-commonUpgrade ceph-immutable-object-cache | Jun 3, 2021 | May 17, 2021 |
| Ubuntu | — | Upgrade ceph-mgr-cephadmUpgrade ceph-baseUpgrade ceph-mgrUpgrade ceph-mgr-k8seventsUpgrade ceph-mgr-modules-coreUpgrade ceph-mgr-rookUpgrade ceph-mgr-diskprediction-localUpgrade cephUpgrade radosgw (Ubuntu Pro)Upgrade ceph-mgr-dashboardUpgrade ceph (Ubuntu Pro)Upgrade cephadmUpgrade ceph-mgr-diskprediction-cloudUpgrade radosgwUpgrade ceph-common (Ubuntu Pro)Upgrade ceph-common | Jun 25, 2021 | May 17, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub