PT-2019-3228 · Ceph+3 · Ceph Rgw+3

Ali Maredia · Publicado 2019-08-28 · Atualizado 2024-02-10 · CVE-2019-10222

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Ceph RGW (affected versions not specified)

Description The issue is related to an uncontrolled resource consumption in the Ceph RGW configuration. An attacker could exploit this by sending valid HTTP headers and then terminating the connection, resulting in a denial of service for Ceph RGW clients. This could be done by an unauthenticated attacker acting remotely.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Improper Handling of Exceptional Conditions

Resource Exhaustion

Enumeração de Fraquezas

CWE-755

CWE-400

Identificadores relacionados

ALT-PU-2019-2841

ALT-PU-2019-2855

BDU:2019-03217

CVE-2019-10222

DLA-3629-1

OPENSUSE-SU-2024:10676-1

RHSA-2019:2577

SUSE-SU-2019:2247-1

SUSE-SU-2019:2736-1

SUSE-SU-2019:2994-1

SUSE-SU-2019_2247-1

SUSE-SU-2019_2736-1

USN-4112-1

Produtos afetados

Alt Linux

Ceph Rgw

Suse

Ubuntu

Referências · 52

• https://github.com/ceph/ceph/pull/29967 · Nota
• https://github.com/ceph/ceph/commit/6171399fdedd928b4249d135b4036e3de25079aa · Nota
• https://bugzilla.suse.com/1147132 · Nota
• https://bugzilla.suse.com/1151992 · Nota
• https://bugzilla.suse.com/1140491 · Nota
• https://bugzilla.suse.com/1135584 · Nota
• https://bugzilla.suse.com/1151990 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2019:2247-1 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2019-10222 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2019-10222 · Nota
• https://altsp.su/obnovleniya-bezopasnosti · Nota
• https://osv.dev/vulnerability/USN-4112-1 · Aviso do Fabricante
• https://usn.ubuntu.com/4112-1 · Nota
• https://bugzilla.suse.com/1151439 · Nota
• https://bugzilla.suse.com/1145759 · Nota