CVE-2015-5245
published 2015-12-03CVE-2015-5245: CRLF injection vulnerability in the Ceph Object Gateway (aka radosgw or RGW) in Ceph before 0.94.4 allows remote attackers to inject arbitrary HTTP headers and…
PriorityP424medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
1.91%
77.5th percentile
CRLF injection vulnerability in the Ceph Object Gateway (aka radosgw or RGW) in Ceph before 0.94.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted bucket name.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | ceph | < ceph 0.80.10-1 (bookworm) | ceph 0.80.10-1 (bookworm) |
| redhat | ceph | <= 0.94.3 | — |
| redhat | ceph | >= 0 < 0.80.10-1 | 0.80.10-1 |
| redhat | ceph | >= 0 < 0.80.10-1 | 0.80.10-1 |
| redhat | ceph | >= 0 < 0.80.10-1 | 0.80.10-1 |
| redhat | ceph | >= 0 < 0.80.10-1 | 0.80.10-1 |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv4.3MEDIUM
vendor_debian4.3MEDIUM
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-782g-wgjp-wr8j: CRLF injection vulnerability in the Ceph Object Gateway (aka radosgw or RGW) in Ceph before 0
ghsa_unreviewed·2022-05-17
CVE-2015-5245 [MEDIUM] GHSA-782g-wgjp-wr8j: CRLF injection vulnerability in the Ceph Object Gateway (aka radosgw or RGW) in Ceph before 0
CRLF injection vulnerability in the Ceph Object Gateway (aka radosgw or RGW) in Ceph before 0.94.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted bucket name.
OSV
CVE-2015-5245: CRLF injection vulnerability in the Ceph Object Gateway (aka radosgw or RGW) in Ceph before 0
osv·2015-12-03·CVSS 4.3
CVE-2015-5245 [MEDIUM] CVE-2015-5245: CRLF injection vulnerability in the Ceph Object Gateway (aka radosgw or RGW) in Ceph before 0
CRLF injection vulnerability in the Ceph Object Gateway (aka radosgw or RGW) in Ceph before 0.94.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted bucket name.
Red Hat
Ceph: RGW returns requested bucket name raw in Bucket response header
vendor_redhat·2015-08-18·CVSS 4.3
CVE-2015-5245 [MEDIUM] CWE-20 Ceph: RGW returns requested bucket name raw in Bucket response header
Ceph: RGW returns requested bucket name raw in Bucket response header
CRLF injection vulnerability in the Ceph Object Gateway (aka radosgw or RGW) in Ceph before 0.94.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted bucket name.
A feature in Ceph Object Gateway (RGW) allows to return a specific HTTP header that contains the name of a bucket that was accessed. It was found that the returned HTTP headers were not sanitized. An unauthenticated attacker could use this flaw to craft HTTP headers in responses that would confuse the load balancer residing in front of RGW, potentially resulting in a denial of service.
Package: ceph (Red Hat Ceph Storage 1.2) - Will not fix
Debian
CVE-2015-5245: ceph - CRLF injection vulnerability in the Ceph Object Gateway (aka radosgw or RGW) in ...
vendor_debian·2015·CVSS 4.3
CVE-2015-5245 [MEDIUM] CVE-2015-5245: ceph - CRLF injection vulnerability in the Ceph Object Gateway (aka radosgw or RGW) in ...
CRLF injection vulnerability in the Ceph Object Gateway (aka radosgw or RGW) in Ceph before 0.94.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted bucket name.
Scope: local
bookworm: resolved (fixed in 0.80.10-1)
bullseye: resolved (fixed in 0.80.10-1)
forky: resolved (fixed in 0.80.10-1)
sid: resolved (fixed in 0.80.10-1)
trixie: resolved (fixed in 0.80.10-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2015-5245 Ceph: RGW returns requested bucket name raw in Bucket response header
bugzilla·2015-09-09·CVSS 4.3
CVE-2015-5245 [MEDIUM] CVE-2015-5245 Ceph: RGW returns requested bucket name raw in Bucket response header
CVE-2015-5245 Ceph: RGW returns requested bucket name raw in Bucket response header
Upstream reports:
PCI scans have determined that the RGW is returning whatever string it thought was the name of the bucket requested as raw text in the Bucket response header, which we are using to be able to track request/response cycles by bucket. The result is that things like this are possible (note the extra Content-type header):
$ curl -i "objects.dreamhost.com/nothing-to-see-here%22%0D%0AContent-type%3A%20%22image-jpg";echo
HTTP/1.1 400 Bad Request
Bucket: "nothing-to-see-here"
Content-type: "image-jpg"
Content-Length: 83
Accept-Ranges: bytes
Content-type: application/xml
Date: Mon, 27 Jul 2015 22:57:11 GMT
InvalidBucketName
This could be considerably worse. It is in fact trivial to make the
arXiv
The Security War in File Systems: An Empirical Study from A Vulnerability-Centric Perspective
arxiv_fulltext·2022-04-26
The Security War in File Systems: An Empirical Study from A Vulnerability-Centric Perspective
The Security War in File Systems: An Empirical Study from A Vulnerability-Centric Perspective
## Abstract
This paper presents a systematic study on the security of modern file systems,
following a vulnerability-centric perspective. Specifically,
we collected 377 file system vulnerabilities committed to the CVE database in the past 20 years.
We characterize them from four dimensions that include why the vulnerabilities appear,
how the vulnerabilities can be exploited, what consequences can arise,
and how the vulnerabilities are fixed. This way, we build a deep understanding of
the attack surfaces faced by file systems, the threats imposed by the attack surfaces,
and the good and bad practices in mitigating the attacks in file systems. We envision that our study
will bring insights toward
http://lists.ceph.com/pipermail/ceph-announce-ceph.com/2015-October/000034.htmlhttp://tracker.ceph.com/issues/12537https://access.redhat.com/errata/RHSA-2015:2512http://lists.ceph.com/pipermail/ceph-announce-ceph.com/2015-October/000034.htmlhttp://tracker.ceph.com/issues/12537https://access.redhat.com/errata/RHSA-2015:2512
2015-12-03
Published