{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update is now available for Red Hat Ceph Storage 3.3 on Ubuntu 16.04.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable version of the Ceph storage system with a Ceph management platform, deployment utilities, and support services.\n\nSecurity Fix(es):\n\n* ceph: Unauthenticated clients can crash ceph RGW configured with beast as frontend (CVE-2019-10222)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2019:2579",
        "url": "https://access.redhat.com/errata/RHSA-2019:2579"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "1739292",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1739292"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2579.json"
      }
    ],
    "title": "Red Hat Security Advisory: ceph security update",
    "tracking": {
      "current_release_date": "2024-11-15T03:14:16+00:00",
      "generator": {
        "date": "2024-11-15T03:14:16+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2019:2579",
      "initial_release_date": "2019-08-28T18:58:22+00:00",
      "revision_history": [
        {
          "date": "2019-08-28T18:58:22+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-08-28T18:58:22+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-15T03:14:16+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Ceph Storage 3 for Ubuntu",
                "product": {
                  "name": "Red Hat Ceph Storage 3 for Ubuntu",
                  "product_id": "Red Hat Ceph Storage 3 for Ubuntu",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:ceph_storage:3::ubuntu16.04"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Ceph Storage"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Abhishek Lekshmanan"
          ],
          "organization": "SUSE Software Solutions Germany"
        }
      ],
      "cve": "CVE-2019-10222",
      "cwe": {
        "id": "CWE-755",
        "name": "Improper Handling of Exceptional Conditions"
      },
      "discovery_date": "2019-08-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1739292"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests. An unauthenticated attacker could crash the Ceph RGW server by sending valid HTTP headers and terminating the connection, resulting in a remote denial of service for Ceph RGW clients.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ceph: Unauthenticated clients can crash ceph RGW configured with beast as frontend",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat OpenStack Platform 13 included some Ceph components at release for in order to support ppc64le. The version provided in the OpenStack repositories is outdated and customers are expected to be using versions provided in Ceph repositories now. Additionally, only the client side and libraries were included which are not affected by this vulnerability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ceph Storage 3 for Ubuntu"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-10222"
        },
        {
          "category": "external",
          "summary": "RHBZ#1739292",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1739292"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-10222",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-10222"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-10222",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10222"
        },
        {
          "category": "external",
          "summary": "https://tracker.ceph.com/issues/40018",
          "url": "https://tracker.ceph.com/issues/40018"
        }
      ],
      "release_date": "2019-08-28T14:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-08-28T18:58:22+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_ceph_storage/3/html-single/installation_guide_for_ubuntu/index#upgrading-the-storage-cluster",
          "product_ids": [
            "Red Hat Ceph Storage 3 for Ubuntu"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:2579"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue either of the following options can be applied to system:\n\nMitigation 1:\n1. By default system will use /etc/init.d/ceph-radosgw\n   stop this service by\n\n~]# /etc/init.d/ceph-radosgw stop\n\n2. Create systemd service, and change command line parameters according to the environment\nwhere Ceph radosgw is running.\n\n~]# cat /usr/lib/systemd/system/ceph-rgw.service \n[Unit]\nDescription=Ceph RGW daemon\n\n[Service]\nType=forking\nExecStart=/bin/radosgw -n client.rgw.$(HOSTNAME REDACTED)\nRestart=on-abnormal\nRestartSec=1s\n\n[Install]\nWantedBy=multi-user.target\n\n3. Run systemd service \u0027ceph-rgw.service\u0027\n\nCaveat: It still takes +1-2 sec to get service back online. After applying above mentioned mitigation, the malicious IP can be blocked by a firewall rule if there are continuous attempts to launch remote denial of service. This mitigation is of limited use if the attack is launched from multiple IPs. It is recommended to limit the exposure of ceph RGW server to known clients.\n\nOR \n\nMitigation 2:\nuse \u0027civetweb\u0027 as HTTP frontend with ceph RGW.",
          "product_ids": [
            "Red Hat Ceph Storage 3 for Ubuntu"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "Red Hat Ceph Storage 3 for Ubuntu"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "ceph: Unauthenticated clients can crash ceph RGW configured with beast as frontend"
    }
  ]
}