7.2 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
6.5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
0.005 Low
EPSS
Percentile
76.3%
Severity: High
Date : 2021-05-19
CVE-ID : CVE-2021-3509 CVE-2021-3524 CVE-2021-3531 CVE-2021-20288
Package : ceph
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-1826
The package ceph before version 15.2.12-1 is vulnerable to multiple
issues including insufficient validation, cross-site scripting, denial
of service and url request injection.
Upgrade to 15.2.12-1.
The problems have been fixed upstream in version 15.2.12.
None.
A security issue was found in ceph before version 15.2.12. In order to
make the JWT token inaccessible through cross-site scripting (XSS), it
was moved from localStorage to httpOnly Cookie (CVE-2020-27839). But
token cookies are used in the body of the HTTP response for the
documentation, which again makes it available to XSS.
A security issue was found in the Red Hat Ceph Storage RadosGW (Ceph
Object Gateway) before version 15.2.12. The vulnerability is related to
the injection of HTTP headers via a CORS ExposeHeader tag. The newline
character in the ExposeHeader tag in the CORS configuration file
generates a header injection in the response when the CORS request is
made.
In addition, the prior bug fix for CVE-2020-10753 did not account for
the use of \r as a header separator, thus a new flaw has been created.
A security issue was found in the Red Hat Ceph Storage RGW before
version 15.2.12. When processing a GET Request for a swift URL that
ends with two slashes it can cause the rgw to crash, resulting in a
denial of service.
An authentication flaw was found in ceph before version 15.2.11. When
the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn’t
sanitize other_keys, allowing key reuse. An attacker who can request a
global_id can exploit the ability of any user to request a global_id
previously associated with another user, as ceph does not force the
reuse of old keys to generate new ones.
A remote attacker could obtain a user’s access token using cross-site
scripting, inject headers into requests to bypass CORS, crash the
server using a crafted request, or reuse old authentication keys.
https://bugs.archlinux.org/task/70450
https://bugzilla.redhat.com/show_bug.cgi?id=1950116
https://github.com/ceph/ceph/commit/7a1ca8d372da3b6a4fc3d221a0e5f72d1d61c27b
https://bugzilla.redhat.com/show_bug.cgi?id=1951674
https://github.com/ceph/ceph/commit/94f7c87a78b05ec856a5ee1ff62af136331776a3
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2021-3531
https://github.com/ceph/ceph/commit/b87e64e3206210580f4a6df2d77f9ae3f1033039
https://www.openwall.com/lists/oss-security/2021/04/14/2
https://bugzilla.redhat.com/show_bug.cgi?id=1938031
https://github.com/ceph/ceph/commit/1f57617d5edb45a8a696eac7c910e8fc44c934a3
https://github.com/ceph/ceph/commit/9f3efe7cd1a780b91e5c8cfee192a0c51d0151dc
https://security.archlinux.org/CVE-2021-3509
https://security.archlinux.org/CVE-2021-3524
https://security.archlinux.org/CVE-2021-3531
https://security.archlinux.org/CVE-2021-20288
bugs.archlinux.org/task/70450
bugzilla.redhat.com/show_bug.cgi?id=1938031
bugzilla.redhat.com/show_bug.cgi?id=1950116
bugzilla.redhat.com/show_bug.cgi?id=1951674
bugzilla.redhat.com/show_bug.cgi?id=CVE-2021-3531
github.com/ceph/ceph/commit/1f57617d5edb45a8a696eac7c910e8fc44c934a3
github.com/ceph/ceph/commit/7a1ca8d372da3b6a4fc3d221a0e5f72d1d61c27b
github.com/ceph/ceph/commit/94f7c87a78b05ec856a5ee1ff62af136331776a3
github.com/ceph/ceph/commit/9f3efe7cd1a780b91e5c8cfee192a0c51d0151dc
github.com/ceph/ceph/commit/b87e64e3206210580f4a6df2d77f9ae3f1033039
security.archlinux.org/AVG-1826
security.archlinux.org/CVE-2021-20288
security.archlinux.org/CVE-2021-3509
security.archlinux.org/CVE-2021-3524
security.archlinux.org/CVE-2021-3531
www.openwall.com/lists/oss-security/2021/04/14/2
7.2 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
6.5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
0.005 Low
EPSS
Percentile
76.3%