A flaw was found in Ceph, relating to the URL processing on RGW backends. An attacker can exploit the URL processing by providing a null URL to crash the RGW, causing a denial of service.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade ceph | Jul 30, 2024 | Mar 6, 2023 |
| Suse | — | Upgrade ceph-mgr-cephadmUpgrade cephfs-shellUpgrade librbd1Upgrade libcephsqliteUpgrade libcephsqlite-develUpgrade rados-objclass-develUpgrade ceph-immutable-object-cacheUpgrade python3-radosUpgrade python3-rbdUpgrade librados-develUpgrade python3-cephfsUpgrade rbd-mirrorUpgrade ceph-mdsUpgrade rbd-fuseUpgrade ceph-monUpgrade rbd-nbdUpgrade ceph-mgr-modules-coreUpgrade cephfs-mirrorUpgrade ceph-commonUpgrade python3-ceph-argparseUpgrade libcephfs-develUpgrade ceph-fuseUpgrade ceph-testUpgrade ceph-mgr-dashboardUpgrade cephUpgrade librgw2Upgrade ceph-baseUpgrade ceph-mgr-rookUpgrade python3-rgwUpgrade cephadmUpgrade ceph-prometheus-alertsUpgrade libcephfs2Upgrade ceph-mgr-diskprediction-localUpgrade libradospp-develUpgrade librados2Upgrade ceph-mgrUpgrade ceph-grafana-dashboardsUpgrade python3-ceph-commonUpgrade ceph-mgr-k8seventsUpgrade librbd-develUpgrade ceph-radosgwUpgrade cephfs-topUpgrade librgw-develUpgrade ceph-osd | Mar 28, 2023 | Mar 6, 2023 |
| Ubuntu | — | Upgrade ceph-baseUpgrade cephUpgrade ceph-common | May 10, 2023 | Mar 6, 2023 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub