Description
A flaw was found in the way Ceph Object Gateway would process cross-origin HTTP requests if the CORS policy was set to allow origin on a bucket. A remote unauthenticated attacker could use this flaw to cause denial of service by sending a specially-crafted cross-origin HTTP request. Ceph branches 1.3.x and 2.x are affected.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | ceph | 1.3 and 2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ceph | 10.2.5-2 | — |
| Debian 13 | ceph | 10.2.5-2 | — |
| Debian 12 | ceph | 10.2.5-2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | ceph | 0.80.11-0ubuntu1.14.04.3 | USN-3452-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Ceph Storage 2 | ceph +21 | 1:10.2.3-17.el7cp | RHSA-2016:2954 |
| Red Hat Ceph Storage 1 | ceph +12 | 1:0.94.9-9.el7cp | RHSA-2016:2994 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Enterprise Storage 4 | ceph +1 | 10.2.6+git.1490339825.57146d8-11.7 | SUSE-SU-2017:1479-1 |
| SUSE Enterprise Storage 3 | ceph | 10.2.10+git.1510313171.6d5f0aeac1-13.7.3 | SUSE-SU-2017:3171-1 |
| SUSE Enterprise Storage 3 | ceph-test | 10.2.10+git.1510313171.6d5f0aeac1-13.7.2 | SUSE-SU-2017:3171-1 |
Advisories 5
- RHSA-2016:2954 Red Hat Security Advisory: Red Hat Ceph Storage 2.1 security and bug fix update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- RHSA-2016:2994 Red Hat Security Advisory: Red Hat Ceph Storage 1.3 security update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- USN-3452-1 ceph vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- SUSE-SU-2017:3171-1 Security update for ceph SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:1479-1 Security update for ceph SUSE / openSUSE Security Updates · May 2, 2025
References
- RHSA-2016:2954 vendor-advisory
- RHSA-2016:2995 vendor-advisory
- 94936 vdb-entry
- RHSA-2016:2994 vendor-advisory
- http://tracker.ceph.com/issues/18187
- RHSA-2016:2956 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9579