A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway). The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made. Ceph versions 3.x and 4.x are vulnerable to this issue.
AI analysis not yet available
Plain-English explanation, risk summary, and remediation steps will appear here once AI analysis is complete.
No Fix Known
No patch has been released yet. Apply workarounds or mitigations where available.
| Vendor | Product | Versions | Fixed In |
|---|---|---|---|
| redhat | ceph_storage | - | - |
| redhat | ceph_storage | - | - |
| redhat | openstack | - |
Published
CVE disclosed publicly
Last Modified
Most recent update
Indexed to CVEInsight
Added to this platform
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
8
Affected Products
14
References
redhat / ceph_storage
| - |
| fedoraproject | fedora | - | - |
| opensuse | leap | - | - |
| linuxfoundation | ceph | 14.2.21 | - |
| canonical | ubuntu_linux | - | - |
| canonical | ubuntu_linux | - | - |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Exploitability
Impact