Debian 10216 Published by

A ceph security update has been released for Debian GNU/Linux 8 Extended LTS to address a vulnerability related to the injection of HTTP headers via a CORS ExposeHeader tag.



ELA-471-1 ceph security update

Package ceph
Version 0.80.7-2+deb8u5
Related CVEs CVE-2020-10753 CVE-2021-3524

A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway). The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made.

For Debian 8 jessie, these problems have been fixed in version 0.80.7-2+deb8u5.

We recommend that you upgrade your ceph packages.

Further information about Extended LTS security advisories can be found at: https://deb.freexian.com/extended-lts/

  ELA-471-1 ceph security update