A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in versions before 14.2.21. The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made. In addition, the prior bug fix for CVE-2020-10753 did not account for the use of \r as a header separator, thus a new flaw has been created.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ceph16Upgrade ceph | Aug 22, 2024 | May 17, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | May 17, 2021 |
| Centos_linux | — | Upgrade ceph-grafana-dashboardsUpgrade libcephfs2-debuginfoUpgrade nfs-ganesha-debuginfoUpgrade python3-rbdUpgrade nfs-ganesha-selinuxUpgrade rbd-fuse-debuginfoUpgrade ceph-debuginfoUpgrade rbd-mirrorUpgrade ceph-commonUpgrade ceph-ansibleUpgrade ceph-immutable-object-cache-debuginfoUpgrade librgw2Upgrade nfs-ganesha-rgw-debuginfoUpgrade python3-rados-debuginfoUpgrade librados-devel-debuginfoUpgrade nfs-ganesha-proxy-debuginfoUpgrade ceph-immutable-object-cacheUpgrade python-cephfsUpgrade libcephfs-develUpgrade python3-cephfsUpgrade nfs-ganesha-rados-urls-debuginfoUpgrade nfs-ganesha-vfs-debuginfoUpgrade python3-radosUpgrade ceph-fuse-debuginfoUpgrade libcephsqlite-debuginfoUpgrade nfs-ganesha-proxyUpgrade libntirpcUpgrade libradosstriper1-debuginfoUpgrade python3-ceph-argparseUpgrade tcmu-runnerUpgrade ceph-mdsUpgrade ceph-fuseUpgrade librados-develUpgrade cephfs-mirrorUpgrade librgw2-debuginfoUpgrade nfs-ganesha-debugsourceUpgrade librbd-develUpgrade libntirpc-debugsourceUpgrade ceph-radosgwUpgrade librgw-develUpgrade rbd-nbdUpgrade libtcmuUpgrade ceph-common-debuginfoUpgrade ceph-resource-agentsUpgrade rbd-mirror-debuginfoUpgrade rbd-nbd-debuginfoUpgrade nfs-ganesha-rados-graceUpgrade ceph-radosgw-debuginfoUpgrade nfs-ganesha-rgwUpgrade libcephfs2Upgrade ceph-base-debuginfoUpgrade python3-rgwUpgrade python3-ceph-commonUpgrade nfs-ganesha-cephUpgrade nfs-ganesha-ceph-debuginfoUpgrade nfs-ganesha-rados-grace-debuginfoUpgrade libradospp-develUpgrade cephfs-topUpgrade ceph-osd-debuginfoUpgrade ceph-debugsourceUpgrade ceph-iscsiUpgrade ceph-baseUpgrade nfs-ganesha-rados-urlsUpgrade python-ceph-argparseUpgrade ceph-mon-debuginfoUpgrade libntirpc-debuginfoUpgrade cephfs-mirror-debuginfoUpgrade libradosstriper1Upgrade ceph-mds-debuginfoUpgrade python3-cephfs-debuginfoUpgrade python3-rbd-debuginfoUpgrade python-rgwUpgrade nfs-ganesha-vfsUpgrade cephadm-ansibleUpgrade cephadmUpgrade nfs-ganeshaUpgrade ceph-test-debuginfoUpgrade ceph-mgr-debuginfoUpgrade python3-rgw-debuginfoUpgrade ceph-selinux | Apr 5, 2022 | May 17, 2021 |
| Debian | — | Upgrade ceph | Aug 12, 2021 | May 17, 2021 |
| Huawei Euleros 2_0_sp3 | — | Upgrade librados2Upgrade ceph-commonUpgrade librbd1Upgrade python-rbdUpgrade python-rados | May 25, 2022 | May 17, 2021 |
| Huawei Euleros 2_0_sp5 | — | Upgrade python-rbdUpgrade ceph-commonUpgrade librbd1Upgrade librados2Upgrade python-rados | Apr 26, 2022 | May 17, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade librados2Upgrade python-radosUpgrade python-rbdUpgrade librbd1 | Aug 10, 2021 | May 17, 2021 |
| Redhat_linux | — | Upgrade ceph-immutable-object-cacheUpgrade librgw2Upgrade nfs-ganesha-debuginfoUpgrade ceph-mgr-debuginfoUpgrade rbd-mirrorUpgrade ceph-mon-debuginfoUpgrade libntirpc-debuginfoUpgrade ceph-iscsiUpgrade ceph-fuse-debuginfoUpgrade cephfs-mirror-debuginfoUpgrade ceph-radosgwUpgrade cephadmUpgrade ceph-ansibleUpgrade ceph-selinuxUpgrade nfs-ganesha-debugsourceUpgrade python-rgwUpgrade nfs-ganesha-rados-urlsUpgrade librbd-develUpgrade nfs-ganesha-proxyUpgrade libradosstriper1-debuginfoUpgrade ceph-mds-debuginfoUpgrade ceph-fuseUpgrade nfs-ganesha-rados-graceUpgrade ceph-test-debuginfoUpgrade rbd-nbdUpgrade libntirpcUpgrade python3-rbd-debuginfoUpgrade ceph-common-debuginfoUpgrade libradosstriper1Upgrade ceph-resource-agentsUpgrade python-cephfsUpgrade python3-rgw-debuginfoUpgrade python-ceph-argparseUpgrade nfs-ganesha-vfsUpgrade ceph-mdsUpgrade ceph-debuginfoUpgrade nfs-ganesha-cephUpgrade nfs-ganeshaUpgrade nfs-ganesha-rados-urls-debuginfoUpgrade nfs-ganesha-ceph-debuginfoUpgrade python3-cephfsUpgrade cephfs-topUpgrade ceph-base-debuginfoUpgrade ceph-osd-debuginfoUpgrade python3-radosUpgrade ceph-immutable-object-cache-debuginfoUpgrade libcephsqlite-debuginfoUpgrade libtcmuUpgrade ceph-radosgw-debuginfoUpgrade nfs-ganesha-rgwUpgrade tcmu-runnerUpgrade python3-rgwUpgrade cephfs-mirrorUpgrade cephadm-ansibleUpgrade librados-develUpgrade nfs-ganesha-vfs-debuginfoUpgrade python3-ceph-commonUpgrade rbd-nbd-debuginfoUpgrade librados-devel-debuginfoUpgrade python3-rados-debuginfoUpgrade ceph-baseUpgrade libcephfs2Upgrade libradospp-develUpgrade libntirpc-debugsourceUpgrade nfs-ganesha-rados-grace-debuginfoUpgrade librgw2-debuginfoUpgrade libcephfs-develUpgrade ceph-commonUpgrade python3-ceph-argparseUpgrade python3-cephfs-debuginfoUpgrade ceph-debugsourceUpgrade rbd-mirror-debuginfoUpgrade librgw-develUpgrade python3-rbdUpgrade nfs-ganesha-proxy-debuginfoUpgrade rbd-fuse-debuginfoUpgrade ceph-grafana-dashboardsUpgrade nfs-ganesha-rgw-debuginfoUpgrade nfs-ganesha-selinuxUpgrade libcephfs2-debuginfo | Apr 5, 2022 | May 17, 2021 |
| Suse | — | Upgrade ceph-monUpgrade librgw-develUpgrade ceph-baseUpgrade rbd-nbdUpgrade ceph-mgrUpgrade librados2Upgrade librbd1Upgrade ceph-mgr-rookUpgrade python3-rbdUpgrade ceph-fuseUpgrade librados-develUpgrade libcephfs2Upgrade python3-radosUpgrade ceph-immutable-object-cacheUpgrade ceph-commonUpgrade ceph-grafana-dashboardsUpgrade libcephfs-develUpgrade rbd-mirrorUpgrade python3-ceph-commonUpgrade rados-objclass-develUpgrade ceph-mgr-cephadmUpgrade ceph-mgr-diskprediction-cloudUpgrade librbd-develUpgrade ceph-mgr-dashboardUpgrade ceph-prometheus-alertsUpgrade cephUpgrade ceph-mgr-k8seventsUpgrade python3-cephfsUpgrade python3-ceph-argparseUpgrade ceph-testUpgrade ceph-mgr-diskprediction-localUpgrade rbd-fuseUpgrade librgw2Upgrade cephadmUpgrade python3-rgwUpgrade ceph-radosgwUpgrade ceph-osdUpgrade libradospp-develUpgrade cephfs-shellUpgrade ceph-mgr-modules-coreUpgrade ceph-mds | Jun 3, 2021 | May 17, 2021 |
| Ubuntu | — | Upgrade ceph-commonUpgrade cephadmUpgrade ceph (Ubuntu Pro)Upgrade ceph-mgr-diskprediction-cloudUpgrade radosgwUpgrade ceph-mgr-dashboardUpgrade ceph-common (Ubuntu Pro)Upgrade ceph-mgr-modules-coreUpgrade ceph-mgr-rookUpgrade ceph-mgrUpgrade cephUpgrade ceph-mgr-diskprediction-localUpgrade ceph-mgr-k8seventsUpgrade radosgw (Ubuntu Pro)Upgrade ceph-mgr-cephadmUpgrade ceph-base | Jun 25, 2021 | May 17, 2021 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub