Medium severity · published Dec 23, 2019
CVE-2019-19337
A flaw was found in Red Hat Ceph Storage version 3 in the way the Ceph RADOS Gateway daemon handles S3 requests
6.5
CVSS
1.3%
EPSS
No
On KEV
Description
A flaw was found in Red Hat Ceph Storage version 3 in the way the Ceph RADOS Gateway daemon handles S3 requests. An authenticated attacker can abuse this flaw by causing a remote denial of service by sending a specially crafted HTTP Content-Length header to the Ceph RADOS Gateway server.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CS
Ceph Storage · Redhat
3.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-19337
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-19337
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19337
More from Ceph Storage
9.8
CVE-2022-26148
An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix
9.8
CVE-2021-20236
A flaw was found in the ZeroMQ server in versions before 4.3.3
9.8
CVE-2018-14649
It was found that ceph-isci-cli package as shipped by Red Hat Ceph Storage 2 and 3 is using python-werkzeug in debug shell mode
9.8
CVE-2018-15727
Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of…
9.1
CVE-2022-0670
A flaw was found in Openstack manilla owning a Ceph File system "share", which enables the owner to read/write any manilla share or entire file system