CVE-2021-3524: debian debian_linux Improper Input Validation
Vulnerability summary
CVE-2021-3524 is a medium (CVSS 6.5) Improper Input Validation vulnerability in debian debian_linux. EPSS estimates a 1.60% chance of exploitation in the next 30 days, higher than 75.8% of scored vulnerabilities.
Not severe (CVSS 6.5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 11 · Related 7Timeline
- 17-05-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in versions before 14.2.21. The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made. In addition, the prior bug fix for CVE-2020-10753 did not account for the use of \r as a header separator, thus a new flaw has been created.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- OSV · AlpineEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
EPSS trend
Probability
1.60%
Chance of exploitation in the next 30 days
Percentile
76%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.60% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream ComponentThe product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Affected systems
Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Alpine2 products
- ceph< 16.2.4-r0
- ceph16< 16.2.4-r0
Debian2 products
- ceph< 14.2.21-1
- debian_linuxEOL9.0
Redhat2 products
- ceph< 14.2.21
- ceph_storage4.0
Fedoraproject1 product
- fedoraEOL32 | 33 | 34
Mageia1 product
- ceph< 15.2.12-1.mga8
Ubuntu1 product
- ceph< 10.2.11-0ubuntu0.16.04.3+esm2 | < 12.2.13-0ubuntu0.18.04.10 | < 15.2.12-0ubuntu0.20.04.1
6 vendors · 9 products
References
18 links- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
