Input validation error in Ceph - CVE-2024-47866
Published: November 14, 2025
Vulnerability identifier: #VU118528
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-47866
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input within the RGWCopyObj::parse_copy_location() function when handling the "x-amz-copy-source" argument with an empty string as its content while copying S3 object. A remote attacker can send a specially crafted HTTP request to the application and perform a denial of service (DoS) attack.
Affected software
Ceph
Storage Ceph
Ubuntu
openEuler
Anolis OS
ceph (Ubuntu package)
ceph-mgr
librados-devel
libcephsqlite-devel
libcephsqlite
libcephfs2
libcephfs-devel
cephfs-mirror
ceph-test
ceph-selinux
ceph-resource-agents
ceph-radosgw
ceph-osd
ceph-mon
ceph-mgr-modules-core
ceph-mds
ceph-immutable-object-cache
ceph-fuse
ceph-debugsource
ceph-debuginfo
ceph-common
ceph-base
ceph
ceph-prometheus-alerts
cephadm
cephfs-top
libradospp-devel
ceph-mgr-rook
ceph-mgr-k8sevents
ceph-mgr-diskprediction-local
ceph-mgr-dashboard
ceph-mgr-cephadm
ceph-grafana-dashboards
rbd-nbd
rbd-mirror
rbd-fuse
rados-objclass-devel
python3-rgw
python3-rbd
python3-rados
python3-cephfs
python3-ceph-common
python3-ceph-argparse
librgw2
librgw-devel
librbd1
librbd-devel
libradosstriper1
libradosstriper-devel
librados2
cephfs-shell
ceph-exporter
ceph-volume
ceph-mib
Storage Ceph
Ubuntu
openEuler
Anolis OS
ceph (Ubuntu package)
ceph-mgr
librados-devel
libcephsqlite-devel
libcephsqlite
libcephfs2
libcephfs-devel
cephfs-mirror
ceph-test
ceph-selinux
ceph-resource-agents
ceph-radosgw
ceph-osd
ceph-mon
ceph-mgr-modules-core
ceph-mds
ceph-immutable-object-cache
ceph-fuse
ceph-debugsource
ceph-debuginfo
ceph-common
ceph-base
ceph
ceph-prometheus-alerts
cephadm
cephfs-top
libradospp-devel
ceph-mgr-rook
ceph-mgr-k8sevents
ceph-mgr-diskprediction-local
ceph-mgr-dashboard
ceph-mgr-cephadm
ceph-grafana-dashboards
rbd-nbd
rbd-mirror
rbd-fuse
rados-objclass-devel
python3-rgw
python3-rbd
python3-rados
python3-cephfs
python3-ceph-common
python3-ceph-argparse
librgw2
librgw-devel
librbd1
librbd-devel
libradosstriper1
libradosstriper-devel
librados2
cephfs-shell
ceph-exporter
ceph-volume
ceph-mib
How to mitigate CVE-2024-47866
Install updates from vendor's website.
Ceph - update to 20.1.0
Storage Ceph - update to 8.1z4
ceph (Ubuntu package) - addressed in versions 0.80.11-0ubuntu1.14.04.4+esm4, 10.2.11-0ubuntu0.16.04.3+esm3, 12.2.13-0ubuntu0.18.04.11+esm2, 15.2.17-0ubuntu0.20.04.6+esm1, 17.2.9-0ubuntu0.22.04.2, 19.2.3-0ubuntu0.24.04.3, 19.2.3-0ubuntu1.25.10.3
ceph-mgr - addressed in versions 16.2.7-25, 18.2.2-11
librados-devel - addressed in versions 16.2.7-25, 18.2.2-11
libcephsqlite-devel - addressed in versions 16.2.7-25, 18.2.2-11
libcephsqlite - addressed in versions 16.2.7-25, 18.2.2-11
libcephfs2 - addressed in versions 16.2.7-25, 18.2.2-11
libcephfs-devel - addressed in versions 16.2.7-25, 18.2.2-11
cephfs-mirror - addressed in versions 16.2.7-25, 18.2.2-11
ceph-test - addressed in versions 16.2.7-25, 18.2.2-11
ceph-selinux - addressed in versions 16.2.7-25, 18.2.2-11
ceph-resource-agents - addressed in versions 16.2.7-25, 18.2.2-11
ceph-radosgw - addressed in versions 16.2.7-25, 18.2.2-11
ceph-osd - addressed in versions 16.2.7-25, 18.2.2-11
ceph-mon - addressed in versions 16.2.7-25, 18.2.2-11
ceph-mgr-modules-core - addressed in versions 16.2.7-25, 18.2.2-11
ceph-mds - addressed in versions 16.2.7-25, 18.2.2-11
ceph-immutable-object-cache - addressed in versions 16.2.7-25, 18.2.2-11
ceph-fuse - addressed in versions 16.2.7-25, 18.2.2-11
ceph-debugsource - addressed in versions 16.2.7-25, 18.2.2-11
ceph-debuginfo - addressed in versions 16.2.7-25, 18.2.2-11
ceph-common - addressed in versions 16.2.7-25, 18.2.2-11
ceph-base - addressed in versions 16.2.7-25, 18.2.2-11
ceph - addressed in versions 16.2.7-25, 18.2.2-11
ceph-prometheus-alerts - addressed in versions 16.2.7-25, 18.2.2-11
cephadm - addressed in versions 16.2.7-25, 18.2.2-11
cephfs-top - addressed in versions 16.2.7-25, 18.2.2-11
libradospp-devel - addressed in versions 16.2.7-25, 18.2.2-11
ceph-mgr-rook - addressed in versions 16.2.7-25, 18.2.2-11
ceph-mgr-k8sevents - addressed in versions 16.2.7-25, 18.2.2-11
ceph-mgr-diskprediction-local - addressed in versions 16.2.7-25, 18.2.2-11
ceph-mgr-dashboard - addressed in versions 16.2.7-25, 18.2.2-11
ceph-mgr-cephadm - addressed in versions 16.2.7-25, 18.2.2-11
ceph-grafana-dashboards - addressed in versions 16.2.7-25, 18.2.2-11
rbd-nbd - addressed in versions 16.2.7-25, 18.2.2-11
rbd-mirror - addressed in versions 16.2.7-25, 18.2.2-11
rbd-fuse - addressed in versions 16.2.7-25, 18.2.2-11
rados-objclass-devel - addressed in versions 16.2.7-25, 18.2.2-11
python3-rgw - addressed in versions 16.2.7-25, 18.2.2-11
python3-rbd - addressed in versions 16.2.7-25, 18.2.2-11
python3-rados - addressed in versions 16.2.7-25, 18.2.2-11
python3-cephfs - addressed in versions 16.2.7-25, 18.2.2-11
python3-ceph-common - addressed in versions 16.2.7-25, 18.2.2-11
python3-ceph-argparse - addressed in versions 16.2.7-25, 18.2.2-11
librgw2 - addressed in versions 16.2.7-25, 18.2.2-11
librgw-devel - addressed in versions 16.2.7-25, 18.2.2-11
librbd1 - addressed in versions 16.2.7-25, 18.2.2-11
librbd-devel - addressed in versions 16.2.7-25, 18.2.2-11
libradosstriper1 - addressed in versions 16.2.7-25, 18.2.2-11
libradosstriper-devel - addressed in versions 16.2.7-25, 18.2.2-11
librados2 - addressed in versions 16.2.7-25, 18.2.2-11
ceph - update to 18.2.1-6
cephfs-mirror - update to 18.2.1-6
librbd1 - update to 18.2.1-6
librbd-devel - update to 18.2.1-6
libradosstriper1 - update to 18.2.1-6
libradosstriper-devel - update to 18.2.1-6
libradospp-devel - update to 18.2.1-6
librados2 - update to 18.2.1-6
librados-devel - update to 18.2.1-6
libcephsqlite-devel - update to 18.2.1-6
libcephsqlite - update to 18.2.1-6
libcephfs2 - update to 18.2.1-6
libcephfs-devel - update to 18.2.1-6
cephfs-shell - update to 18.2.1-6
librgw-devel - update to 18.2.1-6
ceph-test - update to 18.2.1-6
ceph-selinux - update to 18.2.1-6
ceph-radosgw - update to 18.2.1-6
ceph-osd - update to 18.2.1-6
ceph-mon - update to 18.2.1-6
ceph-mgr - update to 18.2.1-6
ceph-mds - update to 18.2.1-6
ceph-immutable-object-cache - update to 18.2.1-6
ceph-fuse - update to 18.2.1-6
ceph-exporter - update to 18.2.1-6
ceph-common - update to 18.2.1-6
ceph-base - update to 18.2.1-6
librgw2 - update to 18.2.1-6
cephfs-top - update to 18.2.1-6
cephadm - update to 18.2.1-6
ceph-volume - update to 18.2.1-6
ceph-resource-agents - update to 18.2.1-6
ceph-prometheus-alerts - update to 18.2.1-6
ceph-mib - update to 18.2.1-6
ceph-mgr-rook - update to 18.2.1-6
ceph-mgr-modules-core - update to 18.2.1-6
ceph-mgr-k8sevents - update to 18.2.1-6
ceph-mgr-diskprediction-local - update to 18.2.1-6
ceph-mgr-dashboard - update to 18.2.1-6
ceph-mgr-cephadm - update to 18.2.1-6
ceph-grafana-dashboards - update to 18.2.1-6
rbd-nbd - update to 18.2.1-6
rbd-mirror - update to 18.2.1-6
rbd-fuse - update to 18.2.1-6
rados-objclass-devel - update to 18.2.1-6
python3-rgw - update to 18.2.1-6
python3-rbd - update to 18.2.1-6
python3-rados - update to 18.2.1-6
python3-cephfs - update to 18.2.1-6
python3-ceph-common - update to 18.2.1-6
python3-ceph-argparse - update to 18.2.1-6
ceph-mib - update to 18.2.2-11
ceph-volume - update to 18.2.2-11
ceph-exporter - update to 18.2.2-11
Storage Ceph - update to 8.1z4
ceph (Ubuntu package) - addressed in versions 0.80.11-0ubuntu1.14.04.4+esm4, 10.2.11-0ubuntu0.16.04.3+esm3, 12.2.13-0ubuntu0.18.04.11+esm2, 15.2.17-0ubuntu0.20.04.6+esm1, 17.2.9-0ubuntu0.22.04.2, 19.2.3-0ubuntu0.24.04.3, 19.2.3-0ubuntu1.25.10.3
ceph-mgr - addressed in versions 16.2.7-25, 18.2.2-11
librados-devel - addressed in versions 16.2.7-25, 18.2.2-11
libcephsqlite-devel - addressed in versions 16.2.7-25, 18.2.2-11
libcephsqlite - addressed in versions 16.2.7-25, 18.2.2-11
libcephfs2 - addressed in versions 16.2.7-25, 18.2.2-11
libcephfs-devel - addressed in versions 16.2.7-25, 18.2.2-11
cephfs-mirror - addressed in versions 16.2.7-25, 18.2.2-11
ceph-test - addressed in versions 16.2.7-25, 18.2.2-11
ceph-selinux - addressed in versions 16.2.7-25, 18.2.2-11
ceph-resource-agents - addressed in versions 16.2.7-25, 18.2.2-11
ceph-radosgw - addressed in versions 16.2.7-25, 18.2.2-11
ceph-osd - addressed in versions 16.2.7-25, 18.2.2-11
ceph-mon - addressed in versions 16.2.7-25, 18.2.2-11
ceph-mgr-modules-core - addressed in versions 16.2.7-25, 18.2.2-11
ceph-mds - addressed in versions 16.2.7-25, 18.2.2-11
ceph-immutable-object-cache - addressed in versions 16.2.7-25, 18.2.2-11
ceph-fuse - addressed in versions 16.2.7-25, 18.2.2-11
ceph-debugsource - addressed in versions 16.2.7-25, 18.2.2-11
ceph-debuginfo - addressed in versions 16.2.7-25, 18.2.2-11
ceph-common - addressed in versions 16.2.7-25, 18.2.2-11
ceph-base - addressed in versions 16.2.7-25, 18.2.2-11
ceph - addressed in versions 16.2.7-25, 18.2.2-11
ceph-prometheus-alerts - addressed in versions 16.2.7-25, 18.2.2-11
cephadm - addressed in versions 16.2.7-25, 18.2.2-11
cephfs-top - addressed in versions 16.2.7-25, 18.2.2-11
libradospp-devel - addressed in versions 16.2.7-25, 18.2.2-11
ceph-mgr-rook - addressed in versions 16.2.7-25, 18.2.2-11
ceph-mgr-k8sevents - addressed in versions 16.2.7-25, 18.2.2-11
ceph-mgr-diskprediction-local - addressed in versions 16.2.7-25, 18.2.2-11
ceph-mgr-dashboard - addressed in versions 16.2.7-25, 18.2.2-11
ceph-mgr-cephadm - addressed in versions 16.2.7-25, 18.2.2-11
ceph-grafana-dashboards - addressed in versions 16.2.7-25, 18.2.2-11
rbd-nbd - addressed in versions 16.2.7-25, 18.2.2-11
rbd-mirror - addressed in versions 16.2.7-25, 18.2.2-11
rbd-fuse - addressed in versions 16.2.7-25, 18.2.2-11
rados-objclass-devel - addressed in versions 16.2.7-25, 18.2.2-11
python3-rgw - addressed in versions 16.2.7-25, 18.2.2-11
python3-rbd - addressed in versions 16.2.7-25, 18.2.2-11
python3-rados - addressed in versions 16.2.7-25, 18.2.2-11
python3-cephfs - addressed in versions 16.2.7-25, 18.2.2-11
python3-ceph-common - addressed in versions 16.2.7-25, 18.2.2-11
python3-ceph-argparse - addressed in versions 16.2.7-25, 18.2.2-11
librgw2 - addressed in versions 16.2.7-25, 18.2.2-11
librgw-devel - addressed in versions 16.2.7-25, 18.2.2-11
librbd1 - addressed in versions 16.2.7-25, 18.2.2-11
librbd-devel - addressed in versions 16.2.7-25, 18.2.2-11
libradosstriper1 - addressed in versions 16.2.7-25, 18.2.2-11
libradosstriper-devel - addressed in versions 16.2.7-25, 18.2.2-11
librados2 - addressed in versions 16.2.7-25, 18.2.2-11
ceph - update to 18.2.1-6
cephfs-mirror - update to 18.2.1-6
librbd1 - update to 18.2.1-6
librbd-devel - update to 18.2.1-6
libradosstriper1 - update to 18.2.1-6
libradosstriper-devel - update to 18.2.1-6
libradospp-devel - update to 18.2.1-6
librados2 - update to 18.2.1-6
librados-devel - update to 18.2.1-6
libcephsqlite-devel - update to 18.2.1-6
libcephsqlite - update to 18.2.1-6
libcephfs2 - update to 18.2.1-6
libcephfs-devel - update to 18.2.1-6
cephfs-shell - update to 18.2.1-6
librgw-devel - update to 18.2.1-6
ceph-test - update to 18.2.1-6
ceph-selinux - update to 18.2.1-6
ceph-radosgw - update to 18.2.1-6
ceph-osd - update to 18.2.1-6
ceph-mon - update to 18.2.1-6
ceph-mgr - update to 18.2.1-6
ceph-mds - update to 18.2.1-6
ceph-immutable-object-cache - update to 18.2.1-6
ceph-fuse - update to 18.2.1-6
ceph-exporter - update to 18.2.1-6
ceph-common - update to 18.2.1-6
ceph-base - update to 18.2.1-6
librgw2 - update to 18.2.1-6
cephfs-top - update to 18.2.1-6
cephadm - update to 18.2.1-6
ceph-volume - update to 18.2.1-6
ceph-resource-agents - update to 18.2.1-6
ceph-prometheus-alerts - update to 18.2.1-6
ceph-mib - update to 18.2.1-6
ceph-mgr-rook - update to 18.2.1-6
ceph-mgr-modules-core - update to 18.2.1-6
ceph-mgr-k8sevents - update to 18.2.1-6
ceph-mgr-diskprediction-local - update to 18.2.1-6
ceph-mgr-dashboard - update to 18.2.1-6
ceph-mgr-cephadm - update to 18.2.1-6
ceph-grafana-dashboards - update to 18.2.1-6
rbd-nbd - update to 18.2.1-6
rbd-mirror - update to 18.2.1-6
rbd-fuse - update to 18.2.1-6
rados-objclass-devel - update to 18.2.1-6
python3-rgw - update to 18.2.1-6
python3-rbd - update to 18.2.1-6
python3-rados - update to 18.2.1-6
python3-cephfs - update to 18.2.1-6
python3-ceph-common - update to 18.2.1-6
python3-ceph-argparse - update to 18.2.1-6
ceph-mib - update to 18.2.2-11
ceph-volume - update to 18.2.2-11
ceph-exporter - update to 18.2.2-11