HTTP response splitting in Ceph - CVE-2021-3524

Vulnerability identifier: #VU114318

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2021-3524

CWE-ID: CWE-113

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform HTTP splitting attacks.

The vulnerability exists due to software does not correctly process CRLF character sequences. A remote attacker can send specially crafted request containing CRLF sequence and make the application to send a split HTTP response.

Successful exploitation of the vulnerability may allow an attacker perform cache poisoning attack.

Ceph
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE MicroOS
SUSE Enterprise Storage
Ubuntu
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Basesystem
openEuler
Fedora
cephadm-ansible (Red Hat package)
ceph (Ubuntu package)
tcmu-runner (Red Hat package)
libntirpc (Red Hat package)
ceph-iscsi (Red Hat package)
nfs-ganesha (Red Hat package)
ceph-ansible (Red Hat package)
python-rsa (Red Hat package)
ceph-mds
ceph-osd
librgw-devel
ceph-common
ceph-mon
python-cephfs
ceph-debugsource
ceph-radosgw
librados2
python-ceph-compat
rbd-nbd
rbd-mirror
ceph
ceph-fuse
rados-objclass-devel
python-rados
ceph-test
ceph-base
python3-cephfs
ceph-debuginfo
python3-rgw
librbd-devel
libradosstriper-devel
ceph-resource-agents
python-rgw
libcephfs-devel
python-rbd
ceph-mgr
librbd1
libcephfs2
rbd-fuse
python3-ceph-argparse
librados-devel
librgw2
python3-rados
libradosstriper1
python3-rbd
ceph-selinux
python3-cephfs-debuginfo
python3-rados-debuginfo
python3-rbd-debuginfo
python3-rgw-debuginfo
ceph-base-debuginfo
librgw2-debuginfo
librbd1-debuginfo
ceph-prometheus-alerts
libradospp-devel
librados2-debuginfo
ceph-radosgw-debuginfo
ceph-mgr-rook
ceph-mgr-diskprediction-local
ceph-mgr-dashboard
ceph-grafana-dashboards
rbd-nbd-debuginfo
rbd-mirror-debuginfo
rbd-fuse-debuginfo
cephfs-shell
ceph-osd-debuginfo
ceph-mon-debuginfo
ceph-mgr-debuginfo
ceph-mds-debuginfo
ceph-fuse-debuginfo
libcephfs2-debuginfo
ceph-common-debuginfo
librados-devel-debuginfo
ceph (Red Hat package)
cephadm
python3-ceph-common
Red Hat Ceph Storage

Install updates from vendor's website.

Ceph - update to 14.2.21
cephadm-ansible (Red Hat package) - update to 0.1-4.g6754c10.el8cp
ceph (Ubuntu package) - addressed in versions 0.80.11-0ubuntu1.14.04.4+esm3, 10.2.11-0ubuntu0.16.04.3+esm2
tcmu-runner (Red Hat package) - addressed in versions 1.5.2-5.el7cp, 1.5.2-5.el8cp, 1.5.4-4.el8cp
libntirpc (Red Hat package) - addressed in versions 3.4-1.1.el7cp, 3.4-1.1.el8cp
ceph-iscsi (Red Hat package) - addressed in versions 3.4-5.el7cp, 3.4-5.el8cp, 3.5-2.el8cp
nfs-ganesha (Red Hat package) - addressed in versions 3.5-1.2.el7cp, 3.5-1.2.el8cp
ceph-ansible (Red Hat package) - addressed in versions 4.0.70.3-1.el7cp, 4.0.70.3-1.el8cp, 6.0.25.4-1.el8cp
Red Hat Ceph Storage - addressed in versions 4.3, 5.1
python-rsa (Red Hat package) - update to 4.8-1.el8cp
ceph-mds - update to 12.2.8-15
ceph-osd - update to 12.2.8-15
librgw-devel - update to 12.2.8-15
ceph-common - update to 12.2.8-15
ceph-mon - update to 12.2.8-15
python-cephfs - update to 12.2.8-15
ceph-debugsource - update to 12.2.8-15
ceph-radosgw - update to 12.2.8-15
librados2 - update to 12.2.8-15
python-ceph-compat - update to 12.2.8-15
rbd-nbd - update to 12.2.8-15
rbd-mirror - update to 12.2.8-15
ceph - update to 12.2.8-15
ceph-fuse - update to 12.2.8-15
rados-objclass-devel - update to 12.2.8-15
python-rados - update to 12.2.8-15
ceph-test - update to 12.2.8-15
ceph-base - update to 12.2.8-15
python3-cephfs - update to 12.2.8-15
ceph-debuginfo - update to 12.2.8-15
python3-rgw - update to 12.2.8-15
librbd-devel - update to 12.2.8-15
libradosstriper-devel - update to 12.2.8-15
ceph-resource-agents - update to 12.2.8-15
python-rgw - update to 12.2.8-15
libcephfs-devel - update to 12.2.8-15
python-rbd - update to 12.2.8-15
ceph-mgr - update to 12.2.8-15
librbd1 - update to 12.2.8-15
libcephfs2 - update to 12.2.8-15
rbd-fuse - update to 12.2.8-15
python3-ceph-argparse - update to 12.2.8-15
librados-devel - update to 12.2.8-15
librgw2 - update to 12.2.8-15
python3-rados - update to 12.2.8-15
libradosstriper1 - update to 12.2.8-15
python3-rbd - update to 12.2.8-15
ceph-selinux - update to 12.2.8-15
ceph - addressed in versions 14.2.21-1.fc32, 15.2.12-1.fc33, 16.2.4-1.fc34
python3-cephfs-debuginfo - addressed in versions 14.2.21.403+g69ab6ea274d-3.63.1, 15.2.12.83+g528da226523-3.25.1
python3-rbd - addressed in versions 14.2.21.403+g69ab6ea274d-3.63.1, 15.2.12.83+g528da226523-3.25.1
python3-rados-debuginfo - addressed in versions 14.2.21.403+g69ab6ea274d-3.63.1, 15.2.12.83+g528da226523-3.25.1
python3-rados - addressed in versions 14.2.21.403+g69ab6ea274d-3.63.1, 15.2.12.83+g528da226523-3.25.1
python3-rbd-debuginfo - addressed in versions 14.2.21.403+g69ab6ea274d-3.63.1, 15.2.12.83+g528da226523-3.25.1
librbd1 - addressed in versions 14.2.21.403+g69ab6ea274d-3.63.1, 15.2.12.83+g528da226523-3.25.1
python3-rgw - addressed in versions 14.2.21.403+g69ab6ea274d-3.63.1, 15.2.12.83+g528da226523-3.25.1
python3-rgw-debuginfo - addressed in versions 14.2.21.403+g69ab6ea274d-3.63.1, 15.2.12.83+g528da226523-3.25.1
rados-objclass-devel - addressed in versions 14.2.21.403+g69ab6ea274d-3.63.1, 15.2.12.83+g528da226523-3.25.1
ceph - update to 14.2.21.403+g69ab6ea274d-3.63.1
ceph-base - addressed in versions 14.2.21.403+g69ab6ea274d-3.63.1, 15.2.12.83+g528da226523-3.25.1
ceph-base-debuginfo - addressed in versions 14.2.21.403+g69ab6ea274d-3.63.1, 15.2.12.83+g528da226523-3.25.1
python3-cephfs - addressed in versions 14.2.21.403+g69ab6ea274d-3.63.1, 15.2.12.83+g528da226523-3.25.1
python3-ceph-argparse - addressed in versions 14.2.21.403+g69ab6ea274d-3.63.1, 15.2.12.83+g528da226523-3.25.1
librgw2-debuginfo - addressed in versions 14.2.21.403+g69ab6ea274d-3.63.1, 15.2.12.83+g528da226523-3.25.1
librgw2 - addressed in versions 14.2.21.403+g69ab6ea274d-3.63.1, 15.2.12.83+g528da226523-3.25.1
librgw-devel - addressed in versions 14.2.21.403+g69ab6ea274d-3.63.1, 15.2.12.83+g528da226523-3.25.1
librbd1-debuginfo - addressed in versions 14.2.21.403+g69ab6ea274d-3.63.1, 15.2.12.83+g528da226523-3.25.1
ceph-prometheus-alerts - update to 14.2.21.403+g69ab6ea274d-3.63.1
librbd-devel - addressed in versions 14.2.21.403+g69ab6ea274d-3.63.1, 15.2.12.83+g528da226523-3.25.1
libradospp-devel - addressed in versions 14.2.21.403+g69ab6ea274d-3.63.1, 15.2.12.83+g528da226523-3.25.1
librados2 - addressed in versions 14.2.21.403+g69ab6ea274d-3.63.1, 15.2.12.83+g528da226523-3.25.1
librados2-debuginfo - addressed in versions 14.2.21.403+g69ab6ea274d-3.63.1, 15.2.12.83+g528da226523-3.25.1
ceph-radosgw-debuginfo - update to 14.2.21.403+g69ab6ea274d-3.63.1
ceph-mgr-rook - update to 14.2.21.403+g69ab6ea274d-3.63.1
ceph-mgr-diskprediction-local - update to 14.2.21.403+g69ab6ea274d-3.63.1
ceph-mgr-dashboard - update to 14.2.21.403+g69ab6ea274d-3.63.1
ceph-grafana-dashboards - update to 14.2.21.403+g69ab6ea274d-3.63.1
rbd-nbd-debuginfo - addressed in versions 14.2.21.403+g69ab6ea274d-3.63.1, 15.2.12.83+g528da226523-3.25.1
rbd-nbd - addressed in versions 14.2.21.403+g69ab6ea274d-3.63.1, 15.2.12.83+g528da226523-3.25.1
rbd-mirror-debuginfo - update to 14.2.21.403+g69ab6ea274d-3.63.1
rbd-mirror - update to 14.2.21.403+g69ab6ea274d-3.63.1
rbd-fuse-debuginfo - update to 14.2.21.403+g69ab6ea274d-3.63.1
rbd-fuse - update to 14.2.21.403+g69ab6ea274d-3.63.1
cephfs-shell - update to 14.2.21.403+g69ab6ea274d-3.63.1
ceph-fuse - update to 14.2.21.403+g69ab6ea274d-3.63.1
ceph-radosgw - update to 14.2.21.403+g69ab6ea274d-3.63.1
ceph-osd-debuginfo - update to 14.2.21.403+g69ab6ea274d-3.63.1
ceph-osd - update to 14.2.21.403+g69ab6ea274d-3.63.1
ceph-mon-debuginfo - update to 14.2.21.403+g69ab6ea274d-3.63.1
ceph-mon - update to 14.2.21.403+g69ab6ea274d-3.63.1
ceph-mgr-debuginfo - update to 14.2.21.403+g69ab6ea274d-3.63.1
ceph-mgr - update to 14.2.21.403+g69ab6ea274d-3.63.1
ceph-mds-debuginfo - update to 14.2.21.403+g69ab6ea274d-3.63.1
ceph-mds - update to 14.2.21.403+g69ab6ea274d-3.63.1
ceph-fuse-debuginfo - update to 14.2.21.403+g69ab6ea274d-3.63.1
librados-devel - addressed in versions 14.2.21.403+g69ab6ea274d-3.63.1, 15.2.12.83+g528da226523-3.25.1
libcephfs2-debuginfo - addressed in versions 14.2.21.403+g69ab6ea274d-3.63.1, 15.2.12.83+g528da226523-3.25.1
libcephfs2 - addressed in versions 14.2.21.403+g69ab6ea274d-3.63.1, 15.2.12.83+g528da226523-3.25.1
libcephfs-devel - addressed in versions 14.2.21.403+g69ab6ea274d-3.63.1, 15.2.12.83+g528da226523-3.25.1
ceph-debugsource - addressed in versions 14.2.21.403+g69ab6ea274d-3.63.1, 15.2.12.83+g528da226523-3.25.1
ceph-common-debuginfo - addressed in versions 14.2.21.403+g69ab6ea274d-3.63.1, 15.2.12.83+g528da226523-3.25.1
ceph-common - addressed in versions 14.2.21.403+g69ab6ea274d-3.63.1, 15.2.12.83+g528da226523-3.25.1
librados-devel-debuginfo - addressed in versions 14.2.21.403+g69ab6ea274d-3.63.1, 15.2.12.83+g528da226523-3.25.1
ceph (Red Hat package) - addressed in versions 14.2.22-110.el7cp, 14.2.22-110.el8cp, 16.2.7-98.el8cp
cephadm - update to 15.2.12.83+g528da226523-3.25.1
python3-ceph-common - update to 15.2.12.83+g528da226523-3.25.1

• https://bugzilla.redhat.com/show_bug.cgi?id=1951674

• HTTP response splitting in Ceph
• Ubuntu update for ceph
• Fedora 34 update for ceph
• Fedora 33 update for ceph
• Fedora 32 update for ceph
• openEuler update for ceph
• Multiple vulnerabilities in Red Hat Ceph Storage 5
• Multiple vulnerabilities in Red Hat Ceph Storage 4
• SUSE update for ceph
• SUSE update for ceph