CVEvulnerability

CVE-2019-3821

7.5 HIGH Published 2019-03-27 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2019-03-27
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.0 ([email protected])
7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:N/A:P
Weaknesses
CWE-772

Description

A flaw was found in the way civetweb frontend was handling requests for ceph RGW server with SSL enabled. An unauthenticated attacker could create multiple connections to ceph RADOS gateway to exhaust file descriptors for ceph-radosgw service resulting in a remote denial of service.

Affected configurations

• ceph civetweb (< 1.11) • canonical ubuntu linux 16.04 • canonical ubuntu linux 18.10 • canonical ubuntu linux 19.04

Related

Weakness · CWE (1)

  • CWE-772 Missing Release of Resource after Effective Lifetime weakness

References