2 lines
5.5 KiB
JSON
2 lines
5.5 KiB
JSON
{"affected":[{"affectedData":[{"product":"ceph","vendor":"n/a","versions":[{"status":"affected","version":"ceph 14.2.21"}]}],"source":"secalert@redhat.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:redhat:ceph:*:*:*:*:*:*:*:*","matchCriteriaId":"B9DCC756-9F64-42E5-B79E-822655CF5A1B","versionEndExcluding":"14.2.21","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:ceph_storage:4.0:*:*:*:*:*:*:*","matchCriteriaId":"D6E54096-5D45-4CB2-AC9A-DDB55BF2B94C","vulnerable":true}],"negate":false,"operator":"OR"}]},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*","matchCriteriaId":"36D96259-24BD-44E2-96D9-78CE1D41F956","vulnerable":true},{"criteria":"cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*","matchCriteriaId":"E460AA51-FCDA-46B9-AE97-E6676AA5E194","vulnerable":true},{"criteria":"cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*","matchCriteriaId":"A930E247-0B43-43CB-98FF-6CE7B8189835","vulnerable":true}],"negate":false,"operator":"OR"}]},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","matchCriteriaId":"DEECE5FC-CACF-4496-A3E7-164736409252","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in versions before 14.2.21. The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made. In addition, the prior bug fix for CVE-2020-10753 did not account for the use of \\r as a header separator, thus a new flaw has been created."},{"lang":"es","value":"Se encontró un fallo en Red Hat Ceph Storage RadosGW (Ceph Object Gateway) en versiones anteriores a la 14.2.21. La vulnerabilidad está relacionada con la inyección de encabezados HTTP por medio de una etiqueta CORS ExposeHeader. El carácter de nueva línea en la etiqueta ExposeHeader en el archivo de configuración CORS genera una inyección de encabezado en la respuesta cuando se realiza la petición CORS. Además, la corrección de bug anterior para CVE-2020-10753 no tenía en cuenta el uso de \\r como separador de encabezado, por lo que un nuevo fallo ha sido creado"}],"id":"CVE-2021-3524","lastModified":"2026-06-17T04:05:17.650","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"MEDIUM","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"NONE","baseScore":4.3,"confidentialityImpact":"NONE","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","version":"2.0"},"exploitabilityScore":8.6,"impactScore":2.9,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":true}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2021-05-17T17:15:08.773","references":[{"source":"secalert@redhat.com","tags":["Issue Tracking","Patch","Vendor Advisory"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1951674"},{"source":"secalert@redhat.com","tags":["Mailing List","Third Party Advisory"],"url":"https://lists.debian.org/debian-lts-announce/2021/08/msg00013.html"},{"source":"secalert@redhat.com","url":"https://lists.debian.org/debian-lts-announce/2023/10/msg00034.html"},{"source":"secalert@redhat.com","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FX5ZHI5L7FOHXOSEV3TYBAL66DMLJ7V5/"},{"source":"secalert@redhat.com","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LPCJN2YDZCBMF4FOJXSTAADKFGEQEO7O/"},{"source":"secalert@redhat.com","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZRUNDH2TJRZRWL3DCH2PQ6KROWTPQ7AJ/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Patch","Vendor Advisory"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1951674"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"url":"https://lists.debian.org/debian-lts-announce/2021/08/msg00013.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://lists.debian.org/debian-lts-announce/2023/10/msg00034.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FX5ZHI5L7FOHXOSEV3TYBAL66DMLJ7V5/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LPCJN2YDZCBMF4FOJXSTAADKFGEQEO7O/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZRUNDH2TJRZRWL3DCH2PQ6KROWTPQ7AJ/"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"secalert@redhat.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-74"}],"source":"nvd@nist.gov","type":"Primary"}]}
|