CVE-2015-5245: redhat ceph

CVSS: 4.3v2.0MediumModified

AliasesSUSE-SU-2016:0806-1RHSA-2015:2066UBUNTU-CVE-2015-5245+1 more

Published 03-12-2015Last modified 06-08-2024

Vulnerability summary

CVE-2015-5245 is a medium (CVSS 4.3) vulnerability in redhat ceph. EPSS estimates a 1.91% chance of exploitation in the next 30 days, higher than 79.4% of scored vulnerabilities.

Overall risk

18/100

0100

Low · default modelHow is this calculated?

CVSS score

4.3/10

010

Medium · v2.0 (NVD)

EPSS score

1.91%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Timeline

03-12-2015
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

CRLF injection vulnerability in the Ceph Object Gateway (aka radosgw or RGW) in Ceph before 0.94.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted bucket name.

CVSS metrics

1 score · 1 source · 1 version

v2.04.3

EPSS trend

Probability

1.91%

Chance of exploitation in the next 30 days

Percentile

79%

Versus all other CVEs

30-day change

0.00 pp

From 1.91% on 18-09-2026

18-09-202618-10-2026

EPSS score

1.91%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Redhat121 products

ceph≤ 0.94.3
babeltrace< 0:1.2.4-3.el7cp
babeltrace-debuginfo< 0:1.2.4-3.el7cp
calamari-server< 0:1.3-11.el7cp
ceph< 1:0.94.3-3.el7cp

ceph-common< 1:0.94.3-3.el7cp
ceph-debuginfo< 1:0.94.3-3.el7cp
ceph-deploy< 0:1.5.27.3-1.el7cp
ceph-mon< 1:0.94.3-3.el7cp
ceph-osd< 1:0.94.3-3.el7cp
ceph-puppet-modules< 0:0.1.1-1.el7cp
ceph-radosgw< 1:0.94.3-3.el7cp
ceph-test< 1:0.94.3-3.el7cp
facter< 1:1.7.6-2.1.el7sat
facter-debuginfo< 1:1.7.6-2.1.el7sat
foreman< 0:1.7.2.33-1.el7sat
foreman-debug< 0:1.7.2.33-1.el7sat
foreman-installer< 1:1.7.5-2.el7cp
foreman-postgresql< 0:1.7.2.33-1.el7sat
foreman-proxy< 0:1.7.2.5-1.el7sat
foreman-release< 0:1.7.2.33-1.el7sat
foreman-selinux< 0:1.7.2.13-1.el7sat
foreman-sqlite< 0:1.7.2.33-1.el7sat
hiera< 0:1.3.1-2.el7
ipxe< 0:20130517-7.1fm.gitc4bce43.el7sat
ipxe-bootimgs< 0:20130517-7.1fm.gitc4bce43.el7sat
ipxe-roms< 0:20130517-7.1fm.gitc4bce43.el7sat
ipxe-roms-qemu< 0:20130517-7.1fm.gitc4bce43.el7sat
libbabeltrace< 0:1.2.4-3.el7cp
librados2< 1:0.94.3-3.el7cp
librados2-devel< 1:0.94.3-3.el7cp
librbd1< 1:0.94.3-3.el7cp
librbd1-devel< 1:0.94.3-3.el7cp
lttng-tools< 0:2.4.1-1.el7cp
lttng-tools-debuginfo< 0:2.4.1-1.el7cp
lttng-ust< 0:2.4.1-1.el7cp
lttng-ust-debuginfo< 0:2.4.1-1.el7cp
mod_passenger< 0:4.0.18-19.el7sat
puppet< 0:3.6.2-4.el7sat
puppet-server< 0:3.6.2-4.el7sat
python-rados< 1:0.94.3-3.el7cp
python-rbd< 1:0.94.3-3.el7cp
radosgw-agent< 0:1.2.3-1.el7cp
rhcs-installer< 0:0.1.0-1.el7cp
ruby-augeas< 0:0.5.0-1.el7
ruby-augeas-debuginfo< 0:0.5.0-1.el7
ruby-rgen< 0:0.6.5-2.el7sat
ruby-shadow< 0:1.4.1-21.el7
ruby-shadow-debuginfo< 0:1.4.1-21.el7
ruby193-facter< 0:1.6.18-5.el7sat
ruby193-ruby-wrapper< 0:0.0.2-6.el7sat
ruby193-rubygem-ancestry< 0:2.0.0-1.el7sat
ruby193-rubygem-apipie-rails< 0:0.2.5-1.el7sat
ruby193-rubygem-audited< 0:3.0.0-5.el7sat
ruby193-rubygem-audited-activerecord< 0:3.0.0-8.el7sat
ruby193-rubygem-bundler_ext< 0:0.3.0-6.el7sat
ruby193-rubygem-deep_cloneable< 0:2.0.0-4.el7
ruby193-rubygem-fast_gettext< 0:0.8.0-13.el7sat
ruby193-rubygem-foreigner< 0:1.4.2-1.el7sat
ruby193-rubygem-foreman_bootdisk< 0:4.0.2.13-1.el7sat
ruby193-rubygem-friendly_id< 0:4.0.10.1-1.el7
ruby193-rubygem-gettext_i18n_rails< 0:0.10.0-3.el7sat
ruby193-rubygem-gettext_i18n_rails_js< 0:0.0.8-3.el7sat
ruby193-rubygem-i18n_data< 0:0.2.7-5.el7sat
ruby193-rubygem-ldap_fluff< 0:0.3.2-1.el7
ruby193-rubygem-multi_json< 0:1.8.2-4.el7sat
ruby193-rubygem-net-ldap< 0:0.3.1-3.el7sat
ruby193-rubygem-oauth< 0:0.4.7-8.el7sat
ruby193-rubygem-passenger< 0:4.0.18-19.el7sat
ruby193-rubygem-passenger-debuginfo< 0:4.0.18-19.el7sat
ruby193-rubygem-passenger-native< 0:4.0.18-19.el7sat
ruby193-rubygem-passenger-native-libs< 0:4.0.18-19.el7sat
ruby193-rubygem-pg< 0:0.12.2-10.el7sat
ruby193-rubygem-pg-debuginfo< 0:0.12.2-10.el7sat
ruby193-rubygem-po_to_json< 0:0.0.7-3.el7sat
ruby193-rubygem-rabl< 0:0.9.0-1.el7sat
ruby193-rubygem-rest-client< 0:1.6.7-1.el7sat
ruby193-rubygem-ruby_parser< 0:3.1.1-15.el7sat
ruby193-rubygem-ruby2ruby< 0:2.0.1-9.el7sat
ruby193-rubygem-safemode< 0:1.2.1-1.el7sat
ruby193-rubygem-scoped_search< 0:2.7.1-2.el7sat
ruby193-rubygem-secure_headers< 0:1.3.3-1.el7
ruby193-rubygem-sexp_processor< 0:4.1.3-7.el7sat
ruby193-rubygem-sprockets< 0:2.10.1-3.el7sat
ruby193-rubygem-uuidtools< 0:2.1.3-6.el7sat
ruby193-rubygem-validates_lengths_from_database< 0:0.2.0-1.3.el7sat
ruby193-rubygem-will_paginate< 0:3.0.2-10.el7sat
rubygem-ansi< 0:1.4.3-3.el7sat
rubygem-apipie-bindings< 0:0.0.11-1.el7
rubygem-awesome_print< 0:1.0.2-12.el7sat
rubygem-bundler_ext< 0:0.3.0-7.el7sat
rubygem-clamp< 0:0.6.2-2.el7sat
rubygem-ffi< 0:1.4.0-3.el7sat
rubygem-ffi-debuginfo< 0:1.4.0-3.el7sat
rubygem-gssapi< 0:1.1.2-4.el7sat
rubygem-hashie< 0:2.0.5-2.el7sat
rubygem-highline< 0:1.6.21-1.el7sat
rubygem-kafo< 0:0.6.5.9-1.el7sat
rubygem-kafo_parsers< 0:0.0.4.4-1.el7sat
rubygem-little-plugger< 0:1.1.3-17.el7sat
rubygem-logging< 0:1.8.1-26.el7sat
rubygem-mime-types< 0:1.19-7.el7sat
rubygem-multi_json< 0:1.8.2-4.el7sat
rubygem-oauth< 0:0.4.7-8.el7sat
rubygem-passenger< 0:4.0.18-19.el7sat
rubygem-passenger-debuginfo< 0:4.0.18-19.el7sat
rubygem-passenger-native< 0:4.0.18-19.el7sat
rubygem-passenger-native-libs< 0:4.0.18-19.el7sat
rubygem-powerbar< 0:1.0.11-8.el7sat
rubygem-rack< 1:1.4.1-13.el7sat
rubygem-rack-protection< 0:1.5.0-7.el7sat
rubygem-rake< 0:0.9.2.2-41.el7sat
rubygem-rest-client< 0:1.6.7-1.el7sat
rubygem-rkerberos< 0:0.1.2-3.el7sat
rubygem-rkerberos-debuginfo< 0:0.1.2-3.el7sat
rubygem-rubyipmi< 0:0.10.0-1.el7sat
rubygem-sinatra< 1:1.3.6-27.el7sat
rubygem-smart_proxy_discovery< 0:1.0.2.1-1.el7sat
rubygem-tilt< 0:1.3.3-18.el7sat
userspace-rcu< 0:0.7.9-2.el7rhgs
userspace-rcu-debuginfo< 0:0.7.9-2.el7rhgs

Show all 121

Debian1 product

ceph< 0.80.10-1

Suse1 product

ceph&distro=SUSE Enterprise Storage 1.0< 0.80.11-8.1

Ubuntu1 product

ceph< 0.80.11-0ubuntu1.14.04.2 | < 10.2.2-0ubuntu0.16.04.2

4 vendors · 124 products

References

38 links

tracker.ceph.com/issues/12537X Refsource CONFIRM
access.redhat.com/errata/RHSA-2015:2512Vendor AdvisoryX Refsource REDHAT
lists.ceph.com/pipermail/ceph-announce-ceph.com/2015-October/000034.htmlMailing ListX Refsource MLISTVendor Advisory
www.suse.com/support/update/announcement/2016/suse-su-20160806-1/Advisory
bugzilla.suse.com/926756REPORT
bugzilla.suse.com/931451REPORT
bugzilla.suse.com/941628REPORT
bugzilla.suse.com/945206REPORT
bugzilla.suse.com/964907REPORT
bugzilla.suse.com/965619REPORT

Show all 38 references

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities