CVE-2019-10222 — Improper Handling of Exceptional Conditions in Ceph Project Ceph

CWE-755 — Improper Handling of Exceptional Conditions9 documents8 sources
Severity
7.5HIGHNVD
EPSS
2.1%
top 15.96%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
THE Ceph Project CephFedoraproject FedoraRedhat Ceph Storage
Timeline
PublishedNov 8
Latest updateMay 24

Description

A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests. An unauthenticated attacker could crash the Ceph RGW server by sending valid HTTP headers and terminating the connection, resulting in a remote denial of service for Ceph RGW clients.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶NVDredhat/ceph_storage3.0, 3.3+1
▶CVEListV5the_ceph_project/cephn/a

Also affects: Fedora 30, 31

Patches

Patch: bugzilla.redhat.com ↗Patch: bugzilla.redhat.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-vr4v-h7xq-hwc6: A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests↗2022-05-24
▶
CVEList
CVE-2019-10222: A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests↗2019-11-08
▶
OSV
CVE-2019-10222: A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests↗2019-11-08
▶

📋Vendor Advisories

3
Ubuntu
Ceph vulnerability↗2019-08-29
▶
Red Hat
ceph: Unauthenticated clients can crash ceph RGW configured with beast as frontend↗2019-08-28
▶
Debian
CVE-2019-10222: ceph - A flaw was found in the Ceph RGW configuration with Beast as the front end handl...↗2019
▶

💬Community

2
Bugzilla
CVE-2019-10222 ceph: Unauthenticated clients can crash ceph RGW configured with beast as frontend [fedora-all]↗2019-08-28
▶
Bugzilla
CVE-2019-10222 ceph: Unauthenticated clients can crash ceph RGW configured with beast as frontend↗2019-08-09
▶