CVE-2021-3531

NameCVE-2021-3531
DescriptionA flaw was found in the Red Hat Ceph Storage RGW in versions before 14.2.21. When processing a GET Request for a swift URL that ends with two slashes it can cause the rgw to crash, resulting in a denial of service. The greatest threat to the system is of availability.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3629-1
Debian Bugs988890

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
ceph (PTS)bullseye14.2.21-1fixed
bookworm16.2.11+ds-2fixed
sid, trixie18.2.4+ds-7fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
cephsourcestretch(not affected)
cephsourcebuster12.2.11+dfsg1-2.1+deb10u1DLA-3629-1
cephsource(unstable)14.2.21-1988890

Notes

[stretch] - ceph <not-affected> (Vulnerable code introduced later)
https://www.openwall.com/lists/oss-security/2021/05/14/5
Nautilus: https://github.com/ceph/ceph/commit/f44a8ae8aa27ecef69528db9aec220f12492810e
Octopus: https://github.com/ceph/ceph/commit/b87e64e3206210580f4a6df2d77f9ae3f1033039
Pacific: https://github.com/ceph/ceph/commit/bf06990ab41d7ac299e4441ad9cd434e926a18e7

Search for package or bug name: Reporting problems