VulnerabilityAnalyzed
CVE-2019-3821
An unauthenticated attacker could create multiple connections to ceph RADOS gateway to exhaust file descriptors for ceph-radosgw service resulting in a remote denial of service.
HIGH 7.5EPSS 2.95%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.95%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A flaw was found in the way civetweb frontend was handling requests for ceph RGW server with SSL enabled. An unauthenticated attacker could create multiple connections to ceph RADOS gateway to exhaust file descriptors for ceph-radosgw service resulting in a remote denial of service.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 2.95% probability · 86th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-772
- Affected
- ceph/civetweb · canonical/ubuntu linux
- Source
- secalert@redhat.com
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3821Issue Tracking, Third Party Advisory
- https://github.com/ceph/civetweb/pull/33Issue Tracking, Third Party Advisory
- https://usn.ubuntu.com/4035-1/Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3821Issue Tracking, Third Party Advisory
- https://github.com/ceph/civetweb/pull/33Issue Tracking, Third Party Advisory
- https://usn.ubuntu.com/4035-1/Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.