CVE-2019-3821

Description

A flaw was found in the way civetweb frontend was handling requests for ceph RGW server with SSL enabled. An unauthenticated attacker could create multiple connections to ceph RADOS gateway to exhaust file descriptors for ceph-radosgw service resulting in a remote denial of service.

CVSS Metrics

• v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• v3.0•HIGH•Score: 7.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• v2.0•MEDIUM•Score: 5AV:N/AC:L/Au:N/C:N/I:N/A:P

EPSS Trends

Current EPSS score: 0.75%• Percentile: 73%

Techniques & Countermeasures

• CWE-772•Missing Release of Resource after Effective Lifetime

  The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.

Affected Systems

• canonical•ubuntu_linux

  16.04 | 18.10 | 19.04

• ceph•civetweb

  < 1.11

• [unknown]•ceph

  n/a

References (3)

• https://usn.ubuntu.com/4035-1/
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3821
• https://github.com/ceph/civetweb/pull/33