CVE-2019-19337 Denial of service in Ceph Storage

Medium 6.5 Published 23 Dec 2019 Updated 5 Aug 2024

An authenticated attacker can cause a remote denial of service in Ceph RADOS Gateway by sending a specially crafted HTTP Content-Length header.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2019-19337?

CVE-2019-19337 is a medium-severity denial of service vulnerability in Red Hat Ceph Storage, published on 23 Dec 2019. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A flaw was found in Red Hat Ceph Storage version 3 in the way the Ceph RADOS Gateway daemon handles S3 requests. An authenticated attacker can abuse this flaw by causing a remote denial of service by sending a specially crafted HTTP Content-Length header to the Ceph RADOS Gateway server.

Weakness: CWE-20

Which versions are affected by CVE-2019-19337?

It affects 1 product.

Linux distribution packages (29)

`ceph` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-84.el7cp`
`ceph-ansible` Red Hat:ceph_storage:3::el7	All versions	`0:3.2.38-1.el7cp`
`ceph-base` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-84.el7cp`
`ceph-common` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-84.el7cp`
`ceph-debuginfo` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-84.el7cp`
`ceph-fuse` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-84.el7cp`
`ceph-mds` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-84.el7cp`
`ceph-mgr` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-84.el7cp`
`ceph-mon` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-84.el7cp`
`ceph-osd` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-84.el7cp`
`ceph-radosgw` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-84.el7cp`
`ceph-selinux` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-84.el7cp`
`ceph-test` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-84.el7cp`
`cephmetrics` Red Hat:ceph_storage:3::el7	All versions	`0:2.0.9-1.el7cp`
`cephmetrics-ansible` Red Hat:ceph_storage:3::el7	All versions	`0:2.0.9-1.el7cp`
`libcephfs-devel` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-84.el7cp`
`libcephfs2` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-84.el7cp`
`librados-devel` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-84.el7cp`
`librados2` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-84.el7cp`
`libradosstriper1` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-84.el7cp`
`librbd-devel` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-84.el7cp`
`librbd1` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-84.el7cp`
`librgw-devel` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-84.el7cp`
`librgw2` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-84.el7cp`
`python-cephfs` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-84.el7cp`
`python-rados` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-84.el7cp`
`python-rbd` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-84.el7cp`
`python-rgw` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-84.el7cp`
`rbd-mirror` Red Hat:ceph_storage:3::el7	All versions	`2:12.2.12-84.el7cp`

Products include Redhat Ceph Storage.

How do I fix CVE-2019-19337?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2019-19337 being exploited?

There is no known exploitation of CVE-2019-19337 in the wild and no public exploit code.

Sources

Also known as GHSA-pg96-f95x-566r, RHSA-2019:4353.