CVE-2021-3524
published 2021-05-17CVE-2021-3524: A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in versions before 14.2.21. The vulnerability is related to the injection of HTTP…
PriorityP433medium6.5CVSS 3.1
AVNACLPRNUIRSUCNIHAN
EPSS
1.61%
73.2th percentile
A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in versions before 14.2.21. The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made. In addition, the prior bug fix for CVE-2020-10753 did not account for the use of \r as a header separator, thus a new flaw has been created.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | ceph | < ceph 14.2.21-1 (bookworm) | ceph 14.2.21-1 (bookworm) |
| debian | debian_linux | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| redhat | ceph | < 14.2.21 | 14.2.21 |
| redhat | ceph | >= 0 < 14.2.21-1 | 14.2.21-1 |
| redhat | ceph | >= 0 < 14.2.21-1 | 14.2.21-1 |
| redhat | ceph | >= 0 < 14.2.21-1 | 14.2.21-1 |
| redhat | ceph | >= 0 < 14.2.21-1 | 14.2.21-1 |
| redhat | ceph | >= 0 < 12.2.13-0ubuntu0.18.04.10 | 12.2.13-0ubuntu0.18.04.10 |
| redhat | ceph | >= 0 < 15.2.12-0ubuntu0.20.04.1 | 15.2.12-0ubuntu0.20.04.1 |
| redhat | ceph | >= 0 < 0.80.11-0ubuntu1.14.04.4+esm3 | 0.80.11-0ubuntu1.14.04.4+esm3 |
| redhat | ceph | >= 0 < 10.2.11-0ubuntu0.16.04.3+esm2 | 10.2.11-0ubuntu0.16.04.3+esm2 |
| redhat | ceph_storage | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv7.1HIGH
vendor_ubuntu7.1HIGH
vendor_debian5.4MEDIUM
vendor_redhat5.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
ceph vulnerabilities
osv·2025-08-20·CVSS 5.7
CVE-2018-14662 [MEDIUM] ceph vulnerabilities
ceph vulnerabilities
It was discovered that Ceph incorrectly handled read-only permissions. An
authenticated attacker could use this issue to obtain dm-crypt encryption
keys. This issue only affected Ubuntu 14.04 LTS. (CVE-2018-14662)
Sergey Bobrov discovered that Ceph’s RadosGW (Ceph Object Gateway) allowed
the injection of HTTP headers in responses to CORS requests. An attacker
could possibly use this issue to compromise system integrity. This issue
only
affected Ubuntu 16.04 LTS. (CVE-2021-3524)
GHSA
GHSA-3rmw-wm6w-rmcr: A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in versions before 14
ghsa_unreviewed·2022-05-24·CVSS 5.4
CVE-2021-3524 [MEDIUM] CWE-20 GHSA-3rmw-wm6w-rmcr: A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in versions before 14
A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in versions before 14.2.21. The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made. In addition, the prior bug fix for CVE-2020-10753 did not account for the use of \r as a header separator, thus a new flaw has been created.
OSV
ceph vulnerabilities
osv·2021-11-01·CVSS 7.1
CVE-2020-27781 [HIGH] ceph vulnerabilities
ceph vulnerabilities
Goutham Pacha Ravi, Jahson Babel, and John Garbutt discovered that user
credentials in Ceph could be manipulated in certain environments. An
attacker could use this to gain unintended access to resources. This issue
only affected Ubuntu 18.04 LTS. (CVE-2020-27781)
It was discovered that Ceph contained an authentication flaw, leading to
key reuse. An attacker could use this to cause a denial of service or
possibly impersonate another user. This issue only affected Ubuntu 21.04.
(CVE-2021-20288)
Sergey Bobrov discovered that the Ceph dashboard was susceptible to a
cross-site scripting attack. An attacker could use this to expose sensitive
information or gain unintended access. This issue only affected Ubuntu
21.04. (CVE-2021-3509)
Sergey Bobrov discovered that Ceph's
OSV
ceph vulnerabilities
osv·2021-06-25·CVSS 4.4
CVE-2020-25678 [MEDIUM] ceph vulnerabilities
ceph vulnerabilities
It was discovered that in some situations Ceph logged passwords from the
mgr module in clear text. An attacker could use this to expose sensitive
information. (CVE-2020-25678)
Goutham Pacha Ravi, Jahson Babel, and John Garbutt discovered that user
credentials in Ceph could be manipulated in certain environments. An
attacker could use this to gain unintended access. (CVE-2020-27781)
It was discovered that the Ceph dashboard was susceptible to a cross-site
scripting attack. An attacker could use this to expose sensitive
information or gain unintended access. (CVE-2020-27839)
It was discovered that Ceph contained an authentication flaw, leading to
key reuse. An attacker could use this to cause a denial of service or
possibly impersonate another user. (CVE-2021-20288)
OSV
CVE-2021-3524: A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in versions before 14
osv·2021-05-17·CVSS 6.5
CVE-2021-3524 [MEDIUM] CVE-2021-3524: A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in versions before 14
A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in versions before 14.2.21. The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made. In addition, the prior bug fix for CVE-2020-10753 did not account for the use of \r as a header separator, thus a new flaw has been created.
Ubuntu
Ceph vulnerabilities
vendor_ubuntu·2025-08-20·CVSS 5.7
CVE-2021-3524 [MEDIUM] Ceph vulnerabilities
Title: Ceph vulnerabilities
Summary: Several security issues were fixed in Ceph.
It was discovered that Ceph incorrectly handled read-only permissions. An
authenticated attacker could use this issue to obtain dm-crypt encryption
keys. This issue only affected Ubuntu 14.04 LTS. (CVE-2018-14662)
Sergey Bobrov discovered that Ceph’s RadosGW (Ceph Object Gateway) allowed
the injection of HTTP headers in responses to CORS requests. An attacker
could possibly use this issue to compromise system integrity. This issue
only
affected Ubuntu 16.04 LTS. (CVE-2021-3524)
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
Ceph vulnerabilities
vendor_ubuntu·2021-11-01·CVSS 7.1
CVE-2021-3531 [HIGH] Ceph vulnerabilities
Title: Ceph vulnerabilities
Summary: Several security issues were fixed in Ceph.
Goutham Pacha Ravi, Jahson Babel, and John Garbutt discovered that user
credentials in Ceph could be manipulated in certain environments. An
attacker could use this to gain unintended access to resources. This issue
only affected Ubuntu 18.04 LTS. (CVE-2020-27781)
It was discovered that Ceph contained an authentication flaw, leading to
key reuse. An attacker could use this to cause a denial of service or
possibly impersonate another user. This issue only affected Ubuntu 21.04.
(CVE-2021-20288)
Sergey Bobrov discovered that the Ceph dashboard was susceptible to a
cross-site scripting attack. An attacker could use this to expose sensitive
information or gain unintended access. This issue only affected Ubuntu
Ubuntu
Ceph vulnerabilities
vendor_ubuntu·2021-06-25·CVSS 4.4
CVE-2021-3509 [MEDIUM] Ceph vulnerabilities
Title: Ceph vulnerabilities
Summary: Several security issues were fixed in Ceph.
It was discovered that in some situations Ceph logged passwords from the
mgr module in clear text. An attacker could use this to expose sensitive
information. (CVE-2020-25678)
Goutham Pacha Ravi, Jahson Babel, and John Garbutt discovered that user
credentials in Ceph could be manipulated in certain environments. An
attacker could use this to gain unintended access. (CVE-2020-27781)
It was discovered that the Ceph dashboard was susceptible to a cross-site
scripting attack. An attacker could use this to expose sensitive
information or gain unintended access. (CVE-2020-27839)
It was discovered that Ceph contained an authentication flaw, leading to
key reuse. An attacker could use this to cause a denial of se
Red Hat
gateway: radosgw: CRLF injection
vendor_redhat·2021-04-15·CVSS 5.4
CVE-2021-3524 [MEDIUM] CWE-20 gateway: radosgw: CRLF injection
gateway: radosgw: CRLF injection
A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in versions before 14.2.21. The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made. In addition, the prior bug fix for CVE-2020-10753 did not account for the use of \r as a header separator, thus a new flaw has been created.
A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway). The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in t
Debian
CVE-2021-3524: ceph - A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in ve...
vendor_debian·2021·CVSS 5.4
CVE-2021-3524 [MEDIUM] CVE-2021-3524: ceph - A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in ve...
A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in versions before 14.2.21. The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made. In addition, the prior bug fix for CVE-2020-10753 did not account for the use of \r as a header separator, thus a new flaw has been created.
Scope: local
bookworm: resolved (fixed in 14.2.21-1)
bullseye: resolved (fixed in 14.2.21-1)
forky: resolved (fixed in 14.2.21-1)
sid: resolved (fixed in 14.2.21-1)
trixie: resolved (fixed in 14.2.21-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://bugzilla.redhat.com/show_bug.cgi?id=1951674https://lists.debian.org/debian-lts-announce/2021/08/msg00013.htmlhttps://lists.debian.org/debian-lts-announce/2023/10/msg00034.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FX5ZHI5L7FOHXOSEV3TYBAL66DMLJ7V5/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LPCJN2YDZCBMF4FOJXSTAADKFGEQEO7O/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZRUNDH2TJRZRWL3DCH2PQ6KROWTPQ7AJ/https://bugzilla.redhat.com/show_bug.cgi?id=1951674https://lists.debian.org/debian-lts-announce/2021/08/msg00013.htmlhttps://lists.debian.org/debian-lts-announce/2023/10/msg00034.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FX5ZHI5L7FOHXOSEV3TYBAL66DMLJ7V5/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LPCJN2YDZCBMF4FOJXSTAADKFGEQEO7O/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZRUNDH2TJRZRWL3DCH2PQ6KROWTPQ7AJ/
2021-05-17
Published