Medium severity · published Jul 31, 2018
CVE-2016-8626
A flaw was found in Red Hat Ceph before 0.94.9-8
6.5
CVSS
2.3%
EPSS
No
On KEV
Description
A flaw was found in Red Hat Ceph before 0.94.9-8. The way Ceph Object Gateway handles POST object requests permits an authenticated attacker to launch a denial of service attack by sending null or specially crafted POST object requests.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CE
Ceph · Red Hat
0.94.9-8 · source: vendor, NVD
EL
Enterprise Linux Desktop · Redhat
7.0 · source: NVD
EL
Enterprise Linux Server · Redhat
7.0 · source: NVD
EL
Enterprise Linux Workstation · Redhat
7.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-8626
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-8626
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2016-2815.html
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2016-2816.html
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2016-2847.html
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2016-2848.html
Patch
http://tracker.ceph.com/issues/17635
Third Party Advisory
http://www.securityfocus.com/bid/94488
More from Ceph
7.5
CVE-2016-9579
A flaw was found in the way Ceph Object Gateway would process cross-origin HTTP requests if the CORS policy was set to allow origin on a bucket