A flaw was found in Ceph, relating to the URL processing on RGW backends. An attacker can exploit the URL processing by providing a null URL to crash the RGW, causing a denial of service.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade ceph | Jul 30, 2024 | Mar 6, 2023 |
| Suse | — | Upgrade ceph-commonUpgrade cephfs-mirrorUpgrade python3-cephfsUpgrade libcephsqlite-develUpgrade rados-objclass-develUpgrade ceph-fuseUpgrade ceph-mdsUpgrade libcephfs-develUpgrade ceph-testUpgrade ceph-mgr-cephadmUpgrade cephfs-shellUpgrade libcephsqliteUpgrade python3-radosUpgrade librados-develUpgrade rbd-nbdUpgrade python3-ceph-argparseUpgrade ceph-monUpgrade rbd-mirrorUpgrade ceph-immutable-object-cacheUpgrade ceph-mgr-modules-coreUpgrade rbd-fuseUpgrade librbd1Upgrade python3-rbdUpgrade ceph-mgr-dashboardUpgrade librgw-develUpgrade ceph-mgr-k8seventsUpgrade ceph-osdUpgrade cephadmUpgrade ceph-mgrUpgrade ceph-prometheus-alertsUpgrade librados2Upgrade python3-ceph-commonUpgrade librbd-develUpgrade ceph-mgr-rookUpgrade ceph-mgr-diskprediction-localUpgrade python3-rgwUpgrade libcephfs2Upgrade ceph-grafana-dashboardsUpgrade libradospp-develUpgrade cephfs-topUpgrade ceph-radosgwUpgrade cephUpgrade ceph-baseUpgrade librgw2 | Mar 28, 2023 | Mar 6, 2023 |
| Ubuntu | — | Upgrade cephUpgrade ceph-commonUpgrade ceph-base | May 10, 2023 | Mar 6, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub