CVE-2016-9579: red hat ceph Improper Input Validation
Vulnerability summary
CVE-2016-9579 is a high (CVSS 7.5) Improper Input Validation vulnerability in red hat ceph. EPSS estimates a 4.34% chance of exploitation in the next 30 days, higher than 91.2% of scored vulnerabilities. 2 public exploits are recorded.
Not severe (CVSS 6.5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 01-08-2018PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
A flaw was found in the way Ceph Object Gateway would process cross-origin HTTP requests if the CORS policy was set to allow origin on a bucket. A remote unauthenticated attacker could use this flaw to cause denial of service by sending a specially-crafted cross-origin HTTP request. Ceph branches 1.3.x and 2.x are affected.
CVSS metrics
6 scores · 5 sources · 2 versions- CVE.orgCNA6.5MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HDiffers
- OSV · Red hatEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HDiffers
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
4.34%
Chance of exploitation in the next 30 days
Percentile
91%
Versus all other CVEs
30-day change
Decrease -0.06 pp
From 4.40% on 05-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
2 foundExploit Reference (tracker.ceph.com)
Maturity: unknown
Exploit Reference (bugzilla.redhat.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat29 products
- ceph_storage1.3 | 2.0
- ceph_storage_mon1.3 | 2
- ceph_storage_osd1.3 | 2
- enterprise_linux_desktop7.0
- enterprise_linux_server7.0
Suse2 products
- ceph-test&distro=SUSE Enterprise Storage 4< 10.2.6+git.1490339825.57146d8-11.7
- ceph&distro=SUSE Enterprise Storage 4< 10.2.6+git.1490339825.57146d8-11.7
Debian1 product
- ceph< 10.2.5-2
Red hat1 product
- ceph1.3 and 2
Ubuntu1 product
- ceph< 0.80.11-0ubuntu1.14.04.3
5 vendors · 34 products
References
32 links- bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9579X Refsource CONFIRMExploitIssue TrackingThird Party Advisory
Show all 32 references
- bugzilla.suse.com/970642REPORT
