A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway). The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made. Ceph versions 3.x and 4.x are vulnerable to this issue.
The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
| Link | Tags |
|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10753 | issue tracking patch vendor advisory |
| http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00062.html | mailing list third party advisory vendor advisory |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FFU7LXEL2UZE565FJBTY7UGH2O7ZUBVS/ | vendor advisory |
| https://usn.ubuntu.com/4528-1/ | third party advisory vendor advisory |
| https://security.gentoo.org/glsa/202105-39 | third party advisory vendor advisory |
| https://lists.debian.org/debian-lts-announce/2021/08/msg00013.html | third party advisory mailing list |
| https://lists.debian.org/debian-lts-announce/2023/10/msg00034.html | mailing list |