CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2018-7262 – ceph: Unauthenticated malformed HTTP requests handled by rgw_civetweb.cc:RGW::init_env() can lead to denial of service
https://notcve.org/view.php?id=CVE-2018-7262
In Ceph before 12.2.3 and 13.x through 13.0.1, the rgw_civetweb.cc RGWCivetWeb::init_env function in radosgw doesn't handle malformed HTTP headers properly, allowing for denial of service. En Ceph, en versiones anteriores a la 12.2.3 y versiones 13.x hasta la 13.0.1, la función RGWCivetWeb::init_env en rgw_civetweb.cc en radosgw no gestiona las cabeceras HTTP mal formadas adecuadamente, lo que permite una denegación de servicio (DoS). A NULL pointer dereference flaw was found in RADOS Gateway HTTP request handling when using the Civetweb native webserver. An unauthenticated attacker could crash RADOS Gateway server by sending malicious HTTP requests. • http://tracker.ceph.com/issues/23039 https://access.redhat.com/errata/RHSA-2018:0546 https://access.redhat.com/errata/RHSA-2018:0548 https://bugzilla.redhat.com/show_bug.cgi?id=1546611 https://github.com/ceph/ceph/pull/20488 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/74VI6EPZ6LD2O4JJXJBTYQ4U4VUO2ZDO https://access.redhat.com/security/cve/CVE-2018-7262 https://bugzilla.redhat.com/show_bug.cgi?id=1546610 • CWE-476: NULL Pointer Dereference •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2017-16818
https://notcve.org/view.php?id=CVE-2017-16818
RADOS Gateway in Ceph 12.1.0 through 12.2.1 allows remote authenticated users to cause a denial of service (assertion failure and application exit) by leveraging "full" (not necessarily admin) privileges to post an invalid profile to the admin API, related to rgw/rgw_iam_policy.cc, rgw/rgw_basic_types.h, and rgw/rgw_iam_types.h. RADOS Gateway en Ceph desde la versión 12.1.0 hasta la 12.2.1 permite que los usuarios autenticados remotos provoquen una denegación de servicio (fallo de aserción y salida de la aplicación) utilizando privilegios "full" (no necesariamente admin) para publicar un perfil no válido en la API admin. Esto está relacionado con rgw/rgw_iam_policy.cc, rgw/rgw_basic_types.h y rgw/rgw_iam_types.h. • https://bugzilla.redhat.com/show_bug.cgi?id=1515872 https://github.com/ceph/ceph/commit/b3118cabb8060a8cc6a01c4e8264cb18e7b1745a https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U6VJA32U7HKGDRJQDJVM7JBYWD4T7BJL • CWE-617: Reachable Assertion •
CVSS: 6.8EPSS: 0%CPEs: 4EXPL: 0CVE-2016-8626 – Ceph: RGW Denial of Service by sending null or specially crafted POST object requests
https://notcve.org/view.php?id=CVE-2016-8626
A flaw was found in Red Hat Ceph before 0.94.9-8. The way Ceph Object Gateway handles POST object requests permits an authenticated attacker to launch a denial of service attack by sending null or specially crafted POST object requests. Se ha descubierto un problema en versiones anteriores a la 0.94.9-8 de Red Hat Ceph. La forma en la que Ceph Object Gateway gestiona las peticiones de objeto POST permite que un atacante autenticado lance un ataque de denegación de servicio (DoS) enviando peticiones de objeto POST null o especialmente manipuladas. A flaw was found in the way Ceph Object Gateway handles POST object requests. • http://rhn.redhat.com/errata/RHSA-2016-2815.html http://rhn.redhat.com/errata/RHSA-2016-2816.html http://rhn.redhat.com/errata/RHSA-2016-2847.html http://rhn.redhat.com/errata/RHSA-2016-2848.html http://tracker.ceph.com/issues/17635 http://www.securityfocus.com/bid/94488 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8626 https://access.redhat.com/security/cve/CVE-2016-8626 https://bugzilla.redhat.com/show_bug.cgi?id=1389193 • CWE-20: Improper Input Validation CWE-476: NULL Pointer Dereference •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 1CVE-2016-7031 – ceph: RGW permits bucket listing when authenticated_users=read
https://notcve.org/view.php?id=CVE-2016-7031
The RGW code in Ceph before 10.0.1, when authenticated-read ACL is applied to a bucket, allows remote attackers to list the bucket contents via a URL. El código RGW en Ceph en versiones anteriores a 10.0.1, cuando la lectura autenticada ACL es aplicada a un compartimento, permite a atacantes remotos listar el contenido del compartimento a través de una URL. A flaw was found in Ceph RGW code which allows an anonymous user to list contents of RGW bucket by bypassing ACL which should only allow authenticated users to list contents of bucket. • http://docs.ceph.com/docs/master/release-notes/#v10-0-1 http://rhn.redhat.com/errata/RHSA-2016-1972.html http://rhn.redhat.com/errata/RHSA-2016-1973.html http://tracker.ceph.com/issues/13207 http://www.securityfocus.com/bid/93240 https://github.com/ceph/ceph/pull/6057 https://access.redhat.com/security/cve/CVE-2016-7031 https://bugzilla.redhat.com/show_bug.cgi?id=1372446 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-254: 7PK - Security Features •
CVSS: 6.5EPSS: 1%CPEs: 7EXPL: 0CVE-2016-5009 – crash: mon_command crashes ceph monitors on receiving empty prefix
https://notcve.org/view.php?id=CVE-2016-5009
The handle_command function in mon/Monitor.cc in Ceph allows remote authenticated users to cause a denial of service (segmentation fault and ceph monitor crash) via an (1) empty or (2) crafted prefix. La función handle_command en mon/Monitor.cc en Ceph permite a usuarios remotos autenticados provocar un denegación de servicio (fallo de segmentación y caída del monitor ceph) a través de un prefijo (1) vacío o (2) manipulado. A flaw was found in the way handle_command() function would validate prefix value from user. An authenticated attacker could send a specially crafted prefix value resulting in ceph monitor crash. • http://lists.opensuse.org/opensuse-updates/2016-12/msg00126.html http://tracker.ceph.com/issues/16297 https://access.redhat.com/errata/RHSA-2016:1384 https://access.redhat.com/errata/RHSA-2016:1385 https://github.com/ceph/ceph/commit/957ece7e95d8f8746191fd9629622d4457d690d6 https://github.com/ceph/ceph/pull/9700 https://access.redhat.com/security/cve/CVE-2016-5009 https://bugzilla.redhat.com/show_bug.cgi?id=1351453 • CWE-20: Improper Input Validation •