Lucene search

[email protected]CVE-2019-10222

HistoryNov 08, 2019 - 3:15 p.m.

CVE-2019-10222

2019-11-0815:15:11

CWE-755

[email protected]

web.nvd.nist.gov

159

ceph

rgw

beast

configuration

http

denial of service

cve-2019-10222

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.3 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

75.1%

JSON

A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests. An unauthenticated attacker could crash the Ceph RGW server by sending valid HTTP headers and terminating the connection, resulting in a remote denial of service for Ceph RGW clients.

Affected configurations

NVD

Node

cephcephMatch-

Node

redhatceph_storageMatch3.0

redhatceph_storageMatch3.3

Node

fedoraprojectfedoraMatch30

fedoraprojectfedoraMatch31

CPENameOperatorVersion
ceph:cephcepheq-

CPE	Name	Operator	Version
ceph:ceph	ceph	eq	-

CNA Affected

[
  {
    "product": "ceph",
    "vendor": "The Ceph Project",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]