ALT Linux Team

Package ceph update in sisyphus on 2020-06-28

ALT-PU-2020-2244-1

Package ceph updated to version 14.2.10-alt1 for branch sisyphus in task 254188.

Closed vulnerabilities

Published: 2020-11-20

BDU:2020-03228

Уязвимость системы хранения данных Ceph, связанная с непринятием мер по обработке последовательностей CRLF в HTTP-заголовках, позволяющая нарушителю внедрить произвольные HTTP-заголовки

Severity: MEDIUM (4.3)
References:
Published: 2020-06-26
Modified: 2024-11-21

CVE-2020-10753

A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway). The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made. Ceph versions 3.x and 4.x are vulnerable to this issue.

Severity: MEDIUM (6.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
References:
VKontakte | Telegram | YouTube | Forum | GitHub | Bugzilla
Version: 2.1.0
Back to top