CVE-2021-3531: Input Validation
A flaw was found in the Red Hat Ceph Storage RGW in versions before 14.2.21. When processing a GET Request for a swift URL that ends with two slashes it can cause the rgw to crash, resulting in a denial of service. The greatest threat to the system is of availability.
Other sources
A flaw was found in the Red Hat Ceph Storage RGW. When processing a GET Request for a swift URL that ends with two slashes it can cause the rgw to crash, resulting in a denial of service.
As an example consider the following curl command: curl https://<rgw-url>/swift/v1/AUTHa1c6e2f79c4b412f9e0335bc6120aeae/foo//<https://%3crgw-url%3e/swift/v1/AUTHa1c6e2f79c4b412f9e0335bc6120aeae/foo/>
the path before the bucket name (before "foo") must be valid for this to work. "foo" does not necessarily need to be a valid bucket name. If it is a valid bucket name it is irrelevant if the bucket itself is public or not. Additional query parameters in the URL still cause this issue (e.g. curl https://<rgw-url>/swift/v1/AUTHa1c6e2f79c4b412f9e0335bc6120aeae/foo//?abc<https://%3crgw-url%3e/swift/v1/AUTHa1c6e2f79c4b412f9e0335bc6120aeae/foo/?abc>)
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/cephto a version that resolves this vulnerability.Fixed in 14.2.21 - Upgrade
Upgrade
Red Hat Ceph Storage RGWto a version that resolves this vulnerability.Fixed in 14.2.21 - Compensating control
For swift URLs handled by RGW, avoid GET requests where the URL ends with two slashes (e.g., paths like /swift/v1/.../foo//). Also avoid cases where additional query parameters are present (e.g., /foo//?abc), as they can still trigger the issue.
Event History
Frequently Asked Questions
What is the severity of CVE-2021-3531?
The severity of CVE-2021-3531 is medium with a CVSS score of 5.3.
What is the impact of CVE-2021-3531?
CVE-2021-3531 can cause the Red Hat Ceph Storage RGW to crash, resulting in a denial of service.
Which versions of Red Hat Ceph Storage RGW are affected by CVE-2021-3531?
Versions before 14.2.21 of Red Hat Ceph Storage RGW are affected by CVE-2021-3531.
How can I fix CVE-2021-3531?
To fix CVE-2021-3531, update Red Hat Ceph Storage RGW to version 14.2.21 or later.
Where can I find more information about CVE-2021-3531?
You can find more information about CVE-2021-3531 on the following references: [https://%3crgw-url%3e/swift/v1/AUTH_a1c6e2f79c4b412f9e0335bc6120aeae/foo/](https://%3crgw-url%3e/swift/v1/AUTH_a1c6e2f79c4b412f9e0335bc6120aeae/foo/), [https://%3crgw-url%3e/swift/v1/AUTH_a1c6e2f79c4b412f9e0335bc6120aeae/foo/?abc](https://%3crgw-url%3e/swift/v1/AUTH_a1c6e2f79c4b412f9e0335bc6120aeae/foo/?abc), [https://github.com/ceph/ceph/commit/f44a8ae8aa27ecef69528db9aec220f12492810e](https://github.com/ceph/ceph/commit/f44a8ae8aa27ecef69528db9aec220f12492810e).