CVE-2019-10222: High severity ceph Ceph vulnerability
A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests. An unauthenticated attacker could crash the Ceph RGW server by sending valid HTTP headers and terminating the connection, resulting in a remote denial of service for Ceph RGW clients.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/cephto a version that resolves this vulnerability.Fixed in 14.2.3-r0 - Upgrade
Upgrade
alpine/ceph16to a version that resolves this vulnerability.Fixed in 14.2.3-r0
Event History
Frequently Asked Questions
What is CVE-2019-10222?
CVE-2019-10222 is a vulnerability in the Ceph RGW configuration with Beast as the front end handling client requests.
What is the severity of CVE-2019-10222?
CVE-2019-10222 has a severity level of 7.5 (high).
How does CVE-2019-10222 affect Ceph and Red Hat Ceph Storage?
CVE-2019-10222 affects Ceph and Red Hat Ceph Storage versions 3.0 and 3.3.
How can an unauthenticated attacker exploit CVE-2019-10222?
An unauthenticated attacker can crash the Ceph RGW server by sending valid HTTP headers and terminating the connection.
How can CVE-2019-10222 be fixed?
Apply the necessary updates or patches provided by the vendor to mitigate the vulnerability in Ceph RGW.