CVE-2024-47866
RGW DoS attack with empty HTTP header in S3 object copy
Summary
RGW DoS attack with empty HTTP header in S3 object copy
Original description
The description as published by the source.
Ceph is a distributed object, block, and file storage platform. In versions up to and including 19.2.3, using the argument x-amz-copy-source to put an object and specifying an empty string as its content leads to the RGW daemon crashing, resulting in a DoS attack. As of time of publication, no known patched versions exist.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Bitnami
ceph
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"20.2.1"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2024-47866 ceph Fixed in: 14.2.21-1+deb11u2
References
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- web openwall.com