Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2021-3524 →
DEBIAN-CVE-2021-3524
A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in versions before 14.2.21. The vulnerability is related to the injection o...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in versions before 14.2.21. The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made. In addition, the prior bug fix for CVE-2020-10753 did not account for the use of \r as a header separator, thus a new flaw has been created.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
ceph
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.21-1"}]}]
Debian:13
ceph
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.21-1"}]}]
Debian:14
ceph
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.21-1"}]}]
Références
- advisory security-tracker.debian.org