CVE-2021-3531

NameCVE-2021-3531
DescriptionA flaw was found in the Red Hat Ceph Storage RGW in versions before 14.2.21. When processing a GET Request for a swift URL that ends with two slashes it can cause the rgw to crash, resulting in a denial of service. The greatest threat to the system is of availability.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium
Debian Bugs988890

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
ceph (PTS)stretch (security), stretch10.2.11-2fixed
buster12.2.11+dfsg1-2.1vulnerable
bullseye, sid14.2.21-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
cephsourcestretch(not affected)
cephsource(unstable)14.2.21-1988890

Notes

[buster] - ceph <no-dsa> (Minor issue)
[stretch] - ceph <not-affected> (Vulnerable code introduced later)
https://www.openwall.com/lists/oss-security/2021/05/14/5
Nautilus: https://github.com/ceph/ceph/commit/f44a8ae8aa27ecef69528db9aec220f12492810e
Octopus: https://github.com/ceph/ceph/commit/b87e64e3206210580f4a6df2d77f9ae3f1033039
Pacific: https://github.com/ceph/ceph/commit/bf06990ab41d7ac299e4441ad9cd434e926a18e7

Search for package or bug name: Reporting problems