CVE-2016-9579 – ceph: Object Gateway server DoS by sending invalid cross-origin HTTP request

https://notcve.org/view.php?id=CVE-2016-9579

A flaw was found in the way Ceph Object Gateway would process cross-origin HTTP requests if the CORS policy was set to allow origin on a bucket. A remote unauthenticated attacker could use this flaw to cause denial of service by sending a specially-crafted cross-origin HTTP request. Ceph branches 1.3.x and 2.x are affected. Se ha encontrado un error en la forma en la que Ceph Object Gateway procesa peticiones HTTP cross-origin si la política CORS está configurada para permitir el origen en un bucket. Un atacante remoto no autenticado podría utilizar este problema para provocar una denegación de servicio (DoS) mediante el envío de una petición HTTP cross-origin especialmente manipulada. • http://rhn.redhat.com/errata/RHSA-2016-2954.html http://rhn.redhat.com/errata/RHSA-2016-2956.html http://rhn.redhat.com/errata/RHSA-2016-2994.html http://rhn.redhat.com/errata/RHSA-2016-2995.html http://tracker.ceph.com/issues/18187 http://www.securityfocus.com/bid/94936 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9579 https://access.redhat.com/security/cve/CVE-2016-9579 https://bugzilla.redhat.com/show_bug.cgi?id=1403245 • CWE-20: Improper Input Validation •