CVE-2021-3524
Fixed in a distro release EPSS 2%
A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in versions before 14.2.21. The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made. In addition, the prior bug fix for CVE-2020-10753 did not account for the use of \r as a header separator, thus a new flaw has been created.
Products: redhat ceph, redhat ceph_storage, fedoraproject fedora, debian_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 10 | ceph | 12.2.11+dfsg1-2.1+deb10u1 |
| Debian 12 | ceph | 14.2.21-1 |
| Debian 13 | ceph | 14.2.21-1 |
| Debian 14 | ceph | 14.2.21-1 |
| Debian 9 | ceph | 10.2.11-2+deb9u1 |
| Red Hat ceph storage 4 | ceph | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | ceph | 2:14.2.22-110.el7cp |
| Red Hat ceph storage 4 | ceph-base | 2:14.2.22-110.el7cp |
| Red Hat ceph storage 4 | ceph-base | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | ceph-base-debuginfo | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | ceph-common | 2:14.2.22-110.el7cp |
| Red Hat ceph storage 4 | ceph-common | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | ceph-common-debuginfo | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | ceph-debuginfo | 2:14.2.22-110.el7cp |
| Red Hat ceph storage 4 | ceph-debugsource | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | ceph-fuse | 2:14.2.22-110.el7cp |
| Red Hat ceph storage 4 | ceph-fuse | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | ceph-fuse-debuginfo | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | ceph-grafana-dashboards | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | ceph-grafana-dashboards | 2:14.2.22-110.el7cp |
| Red Hat ceph storage 4 | ceph-mds | 2:14.2.22-110.el7cp |
| Red Hat ceph storage 4 | ceph-mds | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | ceph-mds-debuginfo | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | ceph-mgr | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | ceph-mgr | 2:14.2.22-110.el7cp |
| Red Hat ceph storage 4 | ceph-mgr-dashboard | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | ceph-mgr-dashboard | 2:14.2.22-110.el7cp |
| Red Hat ceph storage 4 | ceph-mgr-debuginfo | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | ceph-mgr-diskprediction-local | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | ceph-mgr-diskprediction-local | 2:14.2.22-110.el7cp |
| Red Hat ceph storage 4 | ceph-mgr-k8sevents | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | ceph-mgr-k8sevents | 2:14.2.22-110.el7cp |
| Red Hat ceph storage 4 | ceph-mgr-rook | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | ceph-mgr-rook | 2:14.2.22-110.el7cp |
| Red Hat ceph storage 4 | ceph-mon | 2:14.2.22-110.el7cp |
| Red Hat ceph storage 4 | ceph-mon | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | ceph-mon-debuginfo | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | ceph-osd | 2:14.2.22-110.el7cp |
| Red Hat ceph storage 4 | ceph-osd | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | ceph-osd-debuginfo | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | ceph-radosgw | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | ceph-radosgw | 2:14.2.22-110.el7cp |
| Red Hat ceph storage 4 | ceph-radosgw-debuginfo | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | ceph-selinux | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | ceph-selinux | 2:14.2.22-110.el7cp |
| Red Hat ceph storage 4 | ceph-test | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | ceph-test | 2:14.2.22-110.el7cp |
| Red Hat ceph storage 4 | ceph-test-debuginfo | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | libcephfs-devel | 2:14.2.22-110.el7cp |
| Red Hat ceph storage 4 | libcephfs-devel | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | libcephfs2 | 2:14.2.22-110.el7cp |
| Red Hat ceph storage 4 | libcephfs2 | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | libcephfs2-debuginfo | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | librados-devel | 2:14.2.22-110.el7cp |
| Red Hat ceph storage 4 | librados-devel | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | librados-devel-debuginfo | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | librados2 | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | librados2 | 2:14.2.22-110.el7cp |
| Red Hat ceph storage 4 | librados2-debuginfo | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | libradospp-devel | 2:14.2.22-110.el7cp |
| Red Hat ceph storage 4 | libradospp-devel | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | libradosstriper1 | 2:14.2.22-110.el7cp |
| Red Hat ceph storage 4 | libradosstriper1 | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | libradosstriper1-debuginfo | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | librbd-devel | 2:14.2.22-110.el7cp |
| Red Hat ceph storage 4 | librbd-devel | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | librbd1 | 2:14.2.22-110.el7cp |
| Red Hat ceph storage 4 | librbd1 | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | librbd1-debuginfo | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | librgw-devel | 2:14.2.22-110.el7cp |
| Red Hat ceph storage 4 | librgw-devel | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | librgw2 | 2:14.2.22-110.el7cp |
| Red Hat ceph storage 4 | librgw2 | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | librgw2-debuginfo | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | python-ceph-argparse | 2:14.2.22-110.el7cp |
| Red Hat ceph storage 4 | python-cephfs | 2:14.2.22-110.el7cp |
| Red Hat ceph storage 4 | python-rados | 2:14.2.22-110.el7cp |
| Red Hat ceph storage 4 | python-rbd | 2:14.2.22-110.el7cp |
| Red Hat ceph storage 4 | python-rgw | 2:14.2.22-110.el7cp |
| Red Hat ceph storage 4 | python-rsa | 0:4.8-1.el8cp |
| Red Hat ceph storage 4 | python3-ceph-argparse | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | python3-cephfs | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | python3-cephfs-debuginfo | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | python3-rados | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | python3-rados-debuginfo | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | python3-rbd | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | python3-rbd-debuginfo | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | python3-rgw | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | python3-rgw-debuginfo | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | python3-rsa | 0:4.8-1.el8cp |
| Red Hat ceph storage 4 | rbd-fuse-debuginfo | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | rbd-mirror | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | rbd-mirror | 2:14.2.22-110.el7cp |
| Red Hat ceph storage 4 | rbd-mirror-debuginfo | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | rbd-nbd | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 4 | rbd-nbd | 2:14.2.22-110.el7cp |
| Red Hat ceph storage 4 | rbd-nbd-debuginfo | 2:14.2.22-110.el8cp |
| Red Hat ceph storage 5.1 | ceph | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | ceph-base | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | ceph-base-debuginfo | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | ceph-common | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | ceph-common-debuginfo | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | ceph-debugsource | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | ceph-fuse | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | ceph-fuse-debuginfo | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | ceph-grafana-dashboards | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | ceph-immutable-object-cache | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | ceph-immutable-object-cache-debuginfo | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | ceph-mds | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | ceph-mds-debuginfo | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | ceph-mgr | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | ceph-mgr-cephadm | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | ceph-mgr-dashboard | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | ceph-mgr-debuginfo | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | ceph-mgr-diskprediction-local | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | ceph-mgr-k8sevents | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | ceph-mgr-modules-core | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | ceph-mgr-rook | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | ceph-mon | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | ceph-mon-debuginfo | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | ceph-osd | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | ceph-osd-debuginfo | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | ceph-prometheus-alerts | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | ceph-radosgw | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | ceph-radosgw-debuginfo | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | ceph-resource-agents | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | ceph-selinux | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | ceph-test | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | ceph-test-debuginfo | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | cephadm | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | cephfs-mirror | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | cephfs-mirror-debuginfo | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | cephfs-top | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | libcephfs-devel | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | libcephfs2 | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | libcephfs2-debuginfo | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | libcephsqlite | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | libcephsqlite-debuginfo | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | librados-devel | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | librados-devel-debuginfo | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | librados2 | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | librados2-debuginfo | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | libradospp-devel | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | libradosstriper1 | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | libradosstriper1-debuginfo | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | librbd-devel | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | librbd1 | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | librbd1-debuginfo | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | librgw-devel | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | librgw2 | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | librgw2-debuginfo | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | python3-ceph-argparse | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | python3-ceph-common | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | python3-cephfs | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | python3-cephfs-debuginfo | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | python3-rados | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | python3-rados-debuginfo | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | python3-rbd | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | python3-rbd-debuginfo | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | python3-rgw | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | python3-rgw-debuginfo | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | rbd-fuse-debuginfo | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | rbd-mirror | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | rbd-mirror-debuginfo | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | rbd-nbd | 2:16.2.7-98.el8cp |
| Red Hat ceph storage 5.1 | rbd-nbd-debuginfo | 2:16.2.7-98.el8cp |
| SUSE Enterprise Storage 6 | ceph | 14.2.21.403+g69ab6ea274d-3.63.1 |
| SUSE Enterprise Storage 7 | ceph | 15.2.12.83+g528da226523-3.25.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS | ceph | 14.2.21.403+g69ab6ea274d-3.63.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS | ceph | 14.2.21.403+g69ab6ea274d-3.63.1 |
| SUSE Linux Enterprise Micro 5.0 | ceph | 15.2.12.83+g528da226523-3.25.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP2 | ceph | 15.2.12.83+g528da226523-3.25.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP3 | ceph | 15.2.12.83+g528da226523-3.25.1 |
| SUSE Linux Enterprise Server 15 SP1-BCL | ceph | 14.2.21.403+g69ab6ea274d-3.63.1 |
| SUSE Linux Enterprise Server 15 SP1-LTSS | ceph | 14.2.21.403+g69ab6ea274d-3.63.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP1 | ceph | 14.2.21.403+g69ab6ea274d-3.63.1 |
| SUSE Manager Proxy 4.0 | ceph | 14.2.21.403+g69ab6ea274d-3.63.1 |
| SUSE Manager Retail Branch Server 4.0 | ceph | 14.2.21.403+g69ab6ea274d-3.63.1 |
| SUSE Manager Server 4.0 | ceph | 14.2.21.403+g69ab6ea274d-3.63.1 |
| Ubuntu 18.04 LTS | ceph | 12.2.13-0ubuntu0.18.04.10 |
| Ubuntu 20.04 LTS | ceph | 15.2.12-0ubuntu0.20.04.1 |
| Ubuntu Pro 14.04 LTS | ceph | 0.80.11-0ubuntu1.14.04.4+esm3 |
| Ubuntu Pro 16.04 LTS | ceph | 10.2.11-0ubuntu0.16.04.3+esm2 |
| openSUSE Leap 15.2 | ceph | 15.2.12.83+g528da226523-lp152.2.18.1 |
| openSUSE Leap 15.2 | ceph-test | 15.2.12.83+g528da226523-lp152.2.18.1 |
| openSUSE Leap 15.3 | ceph | 15.2.12.83+g528da226523-3.25.1 |
| openSUSE Leap 15.3 | ceph-test | 15.2.12.83+g528da226523-3.25.1 |