Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2024-47866

RGW DoS attack with empty HTTP header in S3 object copy

Description

Ceph is a distributed object, block, and file storage platform. In versions up to and including 19.2.3, using the argument `x-amz-copy-source` to put an object and specifying an empty string as its content leads to the RGW daemon crashing, resulting in a DoS attack. As of time of publication, no known patched versions exist.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ceph ceph

  • <= 19.2.3affected

References