CVE-2019-10222 Denial of service in ceph

High 7.5 Published 8 Nov 2019 Updated 13 Feb 2025

An unauthenticated attacker can crash the Ceph RGW server by sending valid HTTP headers and terminating the connection, causing a remote denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2019-10222?

CVE-2019-10222 is a high-severity denial of service vulnerability in Fedoraproject Fedora, published on 8 Nov 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests. An unauthenticated attacker could crash the Ceph RGW server by sending valid HTTP headers and terminating the connection, resulting in a remote denial of service for Ceph RGW clients.

Weakness: CWE-755

Which versions are affected by CVE-2019-10222?

It affects 3 products.

Linux distribution packages (30)

`ceph` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-48.el7cp`
`ceph-base` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-48.el7cp`
`ceph-common` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-48.el7cp`
`ceph-debuginfo` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-48.el7cp`
`ceph-fuse` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-48.el7cp`
`ceph-mds` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-48.el7cp`
`ceph-mgr` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-48.el7cp`
`ceph-mon` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-48.el7cp`
`ceph-osd` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-48.el7cp`
`ceph-radosgw` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-48.el7cp`
`ceph-selinux` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-48.el7cp`
`ceph-test` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-48.el7cp`
`libcephfs-devel` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-48.el7cp`
`libcephfs2` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-48.el7cp`
`librados-devel` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-48.el7cp`
`librados2` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-48.el7cp`
`libradosstriper1` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-48.el7cp`
`librbd-devel` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-48.el7cp`
`librbd1` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-48.el7cp`
`librgw-devel` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-48.el7cp`
`librgw2` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-48.el7cp`
`python-cephfs` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-48.el7cp`
`python-rados` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-48.el7cp`
`python-rbd` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-48.el7cp`
`python-rgw` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-48.el7cp`
`rbd-mirror` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-48.el7cp`
`ceph` SUSE:Enterprise Storage 6	All versions	`14.2.2.349+g6716a1e448-3.9.1`
`ceph-iscsi` SUSE:Enterprise Storage 6	All versions	`3.3+1570532654.g93940a4-3.7.1`
`ses-manual_en` SUSE:Enterprise Storage 6	All versions	`6+git145.1558531-3.17.1`
`ceph` SUSE:Linux Enterprise Module for Basesystem 15 SP1	All versions	`14.2.2.349+g6716a1e448-3.9.1`

Products include Ceph Ceph, Fedoraproject Fedora, Redhat Ceph Storage.

How do I fix CVE-2019-10222?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2019-10222 being exploited?

There is no known exploitation of CVE-2019-10222 in the wild and no public exploit code.

All Fedoraproject Fedora vulnerabilities

Sources

Also known as DEBIAN-CVE-2019-10222, GHSA-vr4v-h7xq-hwc6, RHSA-2019:2577, SUSE-SU-2019:2247-1, SUSE-SU-2019:2736-1, SUSE-SU-2019:2994-1 and 2 more.