Name | CVE-2021-3531 |
Description | A flaw was found in the Red Hat Ceph Storage RGW in versions before 14.2.21. When processing a GET Request for a swift URL that ends with two slashes it can cause the rgw to crash, resulting in a denial of service. The greatest threat to the system is of availability. |
Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
References | DLA-3629-1 |
Debian Bugs | 988890 |
Vulnerable and fixed packages
The table below lists information on source packages.
Source Package | Release | Version | Status |
---|
ceph (PTS) | bullseye | 14.2.21-1 | fixed |
| bookworm | 16.2.11+ds-2 | fixed |
| sid, trixie | 18.2.4+ds-7 | fixed |
The information below is based on the following data on fixed versions.
Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
---|
ceph | source | stretch | (not affected) | | | |
ceph | source | buster | 12.2.11+dfsg1-2.1+deb10u1 | | DLA-3629-1 | |
ceph | source | (unstable) | 14.2.21-1 | | | 988890 |
Notes
[stretch] - ceph <not-affected> (Vulnerable code introduced later)
https://www.openwall.com/lists/oss-security/2021/05/14/5
Nautilus: https://github.com/ceph/ceph/commit/f44a8ae8aa27ecef69528db9aec220f12492810e
Octopus: https://github.com/ceph/ceph/commit/b87e64e3206210580f4a6df2d77f9ae3f1033039
Pacific: https://github.com/ceph/ceph/commit/bf06990ab41d7ac299e4441ad9cd434e926a18e7