A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in versions before 14.2.21. The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made. In addition, the prior bug fix for CVE-2020-10753 did not account for the use of \r as a header separator, thus a new flaw has been created.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ceph16Upgrade ceph | Aug 22, 2024 | May 17, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | May 17, 2021 |
| Centos_linux | — | Upgrade python3-ceph-argparseUpgrade ceph-mdsUpgrade libntirpc-debugsourceUpgrade librados-develUpgrade libradosstriper1-debuginfoUpgrade tcmu-runnerUpgrade nfs-ganesha-proxy-debuginfoUpgrade python-cephfsUpgrade librbd-develUpgrade nfs-ganesha-proxyUpgrade nfs-ganesha-rados-urls-debuginfoUpgrade nfs-ganesha-vfs-debuginfoUpgrade python3-radosUpgrade rbd-nbdUpgrade ceph-ansibleUpgrade libcephsqlite-debuginfoUpgrade ceph-fuse-debuginfoUpgrade librgw2Upgrade nfs-ganesha-rgw-debuginfoUpgrade python3-cephfsUpgrade python3-rados-debuginfoUpgrade librados-devel-debuginfoUpgrade rbd-mirrorUpgrade libcephfs-develUpgrade librgw-develUpgrade ceph-immutable-object-cacheUpgrade libntirpcUpgrade nfs-ganesha-debugsourceUpgrade ceph-radosgwUpgrade ceph-immutable-object-cache-debuginfoUpgrade librgw2-debuginfoUpgrade nfs-ganesha-selinuxUpgrade cephfs-mirrorUpgrade libtcmuUpgrade rbd-fuse-debuginfoUpgrade ceph-fuseUpgrade nfs-ganesha-debuginfoUpgrade python3-rbdUpgrade ceph-debuginfoUpgrade libcephfs2-debuginfoUpgrade ceph-commonUpgrade ceph-grafana-dashboardsUpgrade rbd-mirror-debuginfoUpgrade rbd-nbd-debuginfoUpgrade ceph-iscsiUpgrade ceph-debugsourceUpgrade libcephfs2Upgrade nfs-ganesha-rgwUpgrade python3-rgwUpgrade nfs-ganesha-ceph-debuginfoUpgrade ceph-radosgw-debuginfoUpgrade ceph-resource-agentsUpgrade nfs-ganesha-rados-graceUpgrade nfs-ganesha-cephUpgrade python-ceph-argparseUpgrade nfs-ganesha-vfsUpgrade cephadm-ansibleUpgrade cephadmUpgrade ceph-common-debuginfoUpgrade python-rgwUpgrade libntirpc-debuginfoUpgrade cephfs-mirror-debuginfoUpgrade ceph-mon-debuginfoUpgrade nfs-ganesha-rados-grace-debuginfoUpgrade libradospp-develUpgrade cephfs-topUpgrade ceph-osd-debuginfoUpgrade ceph-baseUpgrade nfs-ganesha-rados-urlsUpgrade ceph-mds-debuginfoUpgrade python3-cephfs-debuginfoUpgrade python3-rbd-debuginfoUpgrade libradosstriper1Upgrade ceph-selinuxUpgrade nfs-ganeshaUpgrade ceph-test-debuginfoUpgrade ceph-mgr-debuginfoUpgrade python3-rgw-debuginfoUpgrade python3-ceph-commonUpgrade ceph-base-debuginfo | Apr 5, 2022 | May 17, 2021 |
| Debian | — | Upgrade ceph | Aug 12, 2021 | May 17, 2021 |
| Huawei Euleros 2_0_sp3 | — | Upgrade python-radosUpgrade ceph-commonUpgrade librados2Upgrade librbd1Upgrade python-rbd | May 25, 2022 | May 17, 2021 |
| Huawei Euleros 2_0_sp5 | — | Upgrade ceph-commonUpgrade librbd1Upgrade python-radosUpgrade python-rbdUpgrade librados2 | Apr 26, 2022 | May 17, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade librados2Upgrade python-radosUpgrade librbd1Upgrade python-rbd | Aug 10, 2021 | May 17, 2021 |
| Redhat_linux | — | Upgrade ceph-mgr-debuginfoUpgrade ceph-mdsUpgrade ceph-test-debuginfoUpgrade ceph-resource-agentsUpgrade ceph-debuginfoUpgrade ceph-immutable-object-cacheUpgrade python-cephfsUpgrade nfs-ganesha-rados-urls-debuginfoUpgrade ceph-mds-debuginfoUpgrade python3-radosUpgrade ceph-osd-debuginfoUpgrade nfs-ganesha-vfsUpgrade librgw2Upgrade ceph-mon-debuginfoUpgrade cephfs-topUpgrade python-ceph-argparseUpgrade python3-cephfsUpgrade cephadmUpgrade rbd-mirrorUpgrade nfs-ganeshaUpgrade ceph-common-debuginfoUpgrade python-rgwUpgrade cephfs-mirror-debuginfoUpgrade ceph-fuseUpgrade ceph-base-debuginfoUpgrade nfs-ganesha-ceph-debuginfoUpgrade libradosstriper1Upgrade python3-rgw-debuginfoUpgrade nfs-ganesha-cephUpgrade libntirpcUpgrade rbd-nbdUpgrade ceph-fuse-debuginfoUpgrade libntirpc-debuginfoUpgrade nfs-ganesha-rados-graceUpgrade nfs-ganesha-rados-urlsUpgrade libradosstriper1-debuginfoUpgrade nfs-ganesha-proxyUpgrade python3-rbd-debuginfoUpgrade nfs-ganesha-debugsourceUpgrade ceph-radosgwUpgrade ceph-iscsiUpgrade nfs-ganesha-debuginfoUpgrade librbd-develUpgrade ceph-ansibleUpgrade ceph-selinuxUpgrade ceph-debugsourceUpgrade cephfs-mirrorUpgrade python3-ceph-commonUpgrade librados-develUpgrade nfs-ganesha-rgwUpgrade rbd-nbd-debuginfoUpgrade python3-rbdUpgrade librados-devel-debuginfoUpgrade nfs-ganesha-rados-grace-debuginfoUpgrade cephadm-ansibleUpgrade nfs-ganesha-vfs-debuginfoUpgrade libcephfs2-debuginfoUpgrade nfs-ganesha-rgw-debuginfoUpgrade ceph-radosgw-debuginfoUpgrade nfs-ganesha-proxy-debuginfoUpgrade rbd-fuse-debuginfoUpgrade nfs-ganesha-selinuxUpgrade libcephfs2Upgrade ceph-immutable-object-cache-debuginfoUpgrade python3-rados-debuginfoUpgrade ceph-baseUpgrade libntirpc-debugsourceUpgrade libradospp-develUpgrade libcephfs-develUpgrade ceph-grafana-dashboardsUpgrade librgw2-debuginfoUpgrade ceph-commonUpgrade librgw-develUpgrade libtcmuUpgrade python3-ceph-argparseUpgrade rbd-mirror-debuginfoUpgrade python3-cephfs-debuginfoUpgrade python3-rgwUpgrade libcephsqlite-debuginfoUpgrade tcmu-runner | Apr 5, 2022 | May 17, 2021 |
| Suse | — | Upgrade ceph-fuseUpgrade librgw-develUpgrade python3-rbdUpgrade librados2Upgrade rbd-nbdUpgrade ceph-baseUpgrade ceph-mgrUpgrade ceph-grafana-dashboardsUpgrade ceph-immutable-object-cacheUpgrade ceph-mgr-rookUpgrade librados-develUpgrade libcephfs-develUpgrade python3-ceph-commonUpgrade libcephfs2Upgrade python3-radosUpgrade ceph-commonUpgrade ceph-monUpgrade librbd1Upgrade rbd-mirrorUpgrade ceph-mdsUpgrade python3-ceph-argparseUpgrade python3-rgwUpgrade ceph-mgr-diskprediction-cloudUpgrade librbd-develUpgrade libradospp-develUpgrade cephadmUpgrade ceph-osdUpgrade python3-cephfsUpgrade rbd-fuseUpgrade ceph-mgr-k8seventsUpgrade ceph-prometheus-alertsUpgrade ceph-mgr-modules-coreUpgrade rados-objclass-develUpgrade librgw2Upgrade ceph-radosgwUpgrade cephUpgrade ceph-testUpgrade ceph-mgr-dashboardUpgrade cephfs-shellUpgrade ceph-mgr-diskprediction-localUpgrade ceph-mgr-cephadm | Jun 3, 2021 | May 17, 2021 |
| Ubuntu | — | Upgrade ceph-commonUpgrade ceph-common (Ubuntu Pro)Upgrade ceph-mgr-diskprediction-cloudUpgrade radosgwUpgrade ceph (Ubuntu Pro)Upgrade cephadmUpgrade ceph-mgr-dashboardUpgrade ceph-mgr-cephadmUpgrade ceph-mgr-diskprediction-localUpgrade ceph-baseUpgrade ceph-mgrUpgrade radosgw (Ubuntu Pro)Upgrade ceph-mgr-modules-coreUpgrade ceph-mgr-k8seventsUpgrade ceph-mgr-rookUpgrade ceph | Jun 25, 2021 | May 17, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub