Unrated severityNVD Advisory· Published May 17, 2021· Updated Aug 3, 2024
CVE-2021-3524
CVE-2021-3524
Description
A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in versions before 14.2.21. The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made. In addition, the prior bug fix for CVE-2020-10753 did not account for the use of \r as a header separator, thus a new flaw has been created.
Affected products
18- Red Hat Ceph Storage/RadosGWdescription
- osv-coords17 versionspkg:rpm/opensuse/ceph&distro=openSUSE%20Leap%2015.2pkg:rpm/opensuse/ceph&distro=openSUSE%20Leap%2015.3pkg:rpm/opensuse/ceph-test&distro=openSUSE%20Leap%2015.2pkg:rpm/opensuse/ceph-test&distro=openSUSE%20Leap%2015.3pkg:rpm/suse/ceph&distro=SUSE%20Enterprise%20Storage%206pkg:rpm/suse/ceph&distro=SUSE%20Enterprise%20Storage%207pkg:rpm/suse/ceph&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-ESPOSpkg:rpm/suse/ceph&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-LTSSpkg:rpm/suse/ceph&distro=SUSE%20Linux%20Enterprise%20Micro%205.0pkg:rpm/suse/ceph&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP2pkg:rpm/suse/ceph&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP3pkg:rpm/suse/ceph&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-BCLpkg:rpm/suse/ceph&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-LTSSpkg:rpm/suse/ceph&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP1pkg:rpm/suse/ceph&distro=SUSE%20Manager%20Proxy%204.0pkg:rpm/suse/ceph&distro=SUSE%20Manager%20Retail%20Branch%20Server%204.0pkg:rpm/suse/ceph&distro=SUSE%20Manager%20Server%204.0
< 15.2.12.83+g528da226523-lp152.2.18.1+ 16 more
- (no CPE)range: < 15.2.12.83+g528da226523-lp152.2.18.1
- (no CPE)range: < 15.2.12.83+g528da226523-3.25.1
- (no CPE)range: < 15.2.12.83+g528da226523-lp152.2.18.1
- (no CPE)range: < 15.2.12.83+g528da226523-3.25.1
- (no CPE)range: < 14.2.21.403+g69ab6ea274d-3.63.1
- (no CPE)range: < 15.2.12.83+g528da226523-3.25.1
- (no CPE)range: < 14.2.21.403+g69ab6ea274d-3.63.1
- (no CPE)range: < 14.2.21.403+g69ab6ea274d-3.63.1
- (no CPE)range: < 15.2.12.83+g528da226523-3.25.1
- (no CPE)range: < 15.2.12.83+g528da226523-3.25.1
- (no CPE)range: < 15.2.12.83+g528da226523-3.25.1
- (no CPE)range: < 14.2.21.403+g69ab6ea274d-3.63.1
- (no CPE)range: < 14.2.21.403+g69ab6ea274d-3.63.1
- (no CPE)range: < 14.2.21.403+g69ab6ea274d-3.63.1
- (no CPE)range: < 14.2.21.403+g69ab6ea274d-3.63.1
- (no CPE)range: < 14.2.21.403+g69ab6ea274d-3.63.1
- (no CPE)range: < 14.2.21.403+g69ab6ea274d-3.63.1
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
6- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FX5ZHI5L7FOHXOSEV3TYBAL66DMLJ7V5/mitrevendor-advisory
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LPCJN2YDZCBMF4FOJXSTAADKFGEQEO7O/mitrevendor-advisory
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZRUNDH2TJRZRWL3DCH2PQ6KROWTPQ7AJ/mitrevendor-advisory
- lists.debian.org/debian-lts-announce/2021/08/msg00013.htmlmitremailing-list
- lists.debian.org/debian-lts-announce/2023/10/msg00034.htmlmitremailing-list
- bugzilla.redhat.com/show_bug.cgimitre
News mentions
0No linked articles in our index yet.