A flaw was found in Red Hat Ceph Storage version 3 in the way the Ceph RADOS Gateway daemon handles S3 requests.

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• redhat ceph storage3.3

Versions reported by the vendor

Affected version ranges reported by the assigning authority (redhat). Independent of NVD's CPE analysis and usually ahead of it.

• Red Hat Ceph Storage

  • version 3 (upstream versions of Ceph are not affected)affected

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2016-9579A flaw was found in the way Ceph Object Gateway would process cross-origin HTTP requests if the CORS policy was set to allow origin on a buc
  31Monitor
• CVE-2018-1128It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack.
  30Monitor
• CVE-2020-1759A vulnerability was found in Red Hat Ceph Storage 4 and Red Hat Openshift Container Storage 4.2 where, A nonce reuse vulnerability was disco
  27Monitor
• CVE-2022-3854A flaw was found in Ceph, relating to the URL processing on RGW backends.
  26Monitor
• CVE-2021-3979A key length flaw was found in Red Hat Ceph Storage.
  26Monitor
• CVE-2020-10753A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway).
  26Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.