Description
The RGW code in Ceph before 10.0.1, when authenticated-read ACL is applied to a bucket, allows remote attackers to list the bucket contents via a URL.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ceph | 10.2.5-1 | — |
| Debian 13 | ceph | 10.2.5-1 | — |
| Debian 12 | ceph | 10.2.5-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | ceph | 0.80.11-0ubuntu1.14.04.3 | USN-3452-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Ceph Storage 1 | calamari-server | 1.3.3-2.el7cp | RHSA-2016:1972 |
| Red Hat Ceph Storage 1 | ceph +12 | 1:0.94.9-3.el7cp | RHSA-2016:1972 |
| Red Hat Ceph Storage 1 | ceph-deploy | 1.5.36-1.el7cp | RHSA-2016:1972 |
| Red Hat Ceph Storage 1 | radosgw-agent | 1.2.7-1.el7cp | RHSA-2016:1972 |
Advisories 2
- RHSA-2016:1972 Red Hat Security Advisory: Red Hat Ceph Storage 1.3.3 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- USN-3452-1 ceph vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
References
- 93240 vdb-entry
- https://github.com/ceph/ceph/pull/6057
- RHSA-2016:1972 vendor-advisory
- http://docs.ceph.com/docs/master/release-notes/#v10-0-1
- RHSA-2016:1973 vendor-advisory
- http://tracker.ceph.com/issues/13207