Description
A flaw was found in Red Hat Ceph before 0.94.9-8. The way Ceph Object Gateway handles POST object requests permits an authenticated attacker to launch a denial of service attack by sending null or specially crafted POST object requests.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Ceph | 0.94.9-8 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ceph | 10.2.5-1 | — |
| Debian 13 | ceph | 10.2.5-1 | — |
| Debian 12 | ceph | 10.2.5-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | ceph | 0.80.11-0ubuntu1.14.04.3 | USN-3452-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Ceph Storage 2 | calamari-server | 1.4.9-1.el7cp | RHSA-2016:2815 |
| Red Hat Ceph Storage 2 | ceph +21 | 1:10.2.3-13.el7cp | RHSA-2016:2815 |
| Red Hat Ceph Storage 2 | ceph-deploy | 1.5.36-20.el7cp | RHSA-2016:2815 |
| Red Hat Ceph Storage 2 | ceph-iscsi-config | 1.5-1.el7cp | RHSA-2016:2815 |
| Red Hat Ceph Storage 2 | ceph-iscsi-tools | 1.1-1.el7cp | RHSA-2016:2815 |
| Red Hat Ceph Storage 2 | libntirpc | 1.4.1-1.el7 | RHSA-2016:2815 |
| Red Hat Ceph Storage 2 | nfs-ganesha +1 | 2.4.0-3.el7cp | RHSA-2016:2815 |
| Red Hat Ceph Storage 1 | ceph +12 | 1:0.94.9-8.el7cp | RHSA-2016:2847 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Enterprise Storage 3 | ceph +1 | 10.2.5+git.1485186288.4e3c6c4-12.2 | SUSE-SU-2017:0758-1 |
Advisories 4
- RHSA-2016:2847 Red Hat Security Advisory: Red Hat Ceph Storage 1.3 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- RHSA-2016:2815 Red Hat Security Advisory: Red Hat Ceph Storage security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- USN-3452-1 ceph vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- SUSE-SU-2017:0758-1 Security update for ceph SUSE / openSUSE Security Updates · Feb 4, 2026
References
- http://tracker.ceph.com/issues/17635
- RHSA-2016:2815 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8626
- 94488 vdb-entry
- RHSA-2016:2816 vendor-advisory
- RHSA-2016:2847 vendor-advisory
- RHSA-2016:2848 vendor-advisory