ceph14 -- HTTP header injection via CORS ExposeHeader tag

Red Hat bugzilla reports:

A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway).
The vulnerability is related to the injection of HTTP headers via a CORS
ExposeHeader tag. The newline character in the ExposeHeader tag in the
CORS configuration file generates a header injection in the response
when the CORS request is made.