Veracode Vulnerability DatabaseVERACODE:11837CRLF Injection
0.002 Low
EPSS
Percentile
58.8%
ceph is vulnerable to CRLF injection attacks. The vulnerability exists the Ceph Object Gateway (aka radosgw or RGW) in Ceph before 0.94.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted bucket name.
References
lists.ceph.com/pipermail/ceph-announce-ceph.com/2015-October/000034.html
tracker.ceph.com/issues/12537
access.redhat.com/errata/RHSA-2015:2066
access.redhat.com/errata/RHSA-2015:2512
access.redhat.com/security/cve/CVE-2015-5245
access.redhat.com/security/updates/classification/#moderate
access.redhat.com/support/offerings/techpreview/
bugzilla.redhat.com/show_bug.cgi?id=1210825
bugzilla.redhat.com/show_bug.cgi?id=1219040
bugzilla.redhat.com/show_bug.cgi?id=1220961
bugzilla.redhat.com/show_bug.cgi?id=1223532
bugzilla.redhat.com/show_bug.cgi?id=1223941
bugzilla.redhat.com/show_bug.cgi?id=1224174
bugzilla.redhat.com/show_bug.cgi?id=1224877
bugzilla.redhat.com/show_bug.cgi?id=1228842
bugzilla.redhat.com/show_bug.cgi?id=1235845
bugzilla.redhat.com/show_bug.cgi?id=1238415
bugzilla.redhat.com/show_bug.cgi?id=1253766
bugzilla.redhat.com/show_bug.cgi?id=1254814
bugzilla.redhat.com/show_bug.cgi?id=1255830
bugzilla.redhat.com/show_bug.cgi?id=1258618
bugzilla.redhat.com/show_bug.cgi?id=1258621
bugzilla.redhat.com/show_bug.cgi?id=1261606
bugzilla.redhat.com/show_bug.cgi?id=1265973
bugzilla.redhat.com/show_bug.cgi?id=1277393
rhn.redhat.com/errata/RHSA-2015-2066.html
Related
