Unscored severity · published Dec 3, 2015
CVE-2015-5245
CRLF injection vulnerability in the Ceph Object Gateway (aka radosgw or RGW) in Ceph before 0.94.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP…
–
CVSS
1.9%
EPSS
No
On KEV
Description
CRLF injection vulnerability in the Ceph Object Gateway (aka radosgw or RGW) in Ceph before 0.94.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted bucket name.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CE
Ceph · Redhat
through 0.94.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-5245
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-5245
Vendor Advisory
http://lists.ceph.com/pipermail/ceph-announce-ceph.com/2015-October/000034.html
tracker.ceph.com
http://tracker.ceph.com/issues/12537
access.redhat.com
https://access.redhat.com/errata/RHSA-2015:2512
More from Ceph
8.8
CVE-2020-25660
A flaw was found in the Cephx authentication protocol in versions before 15.2.6 and before 14.2.14, where it does not verify Ceph clients correctly and is then vulnerable to…
7.8
CVE-2022-3650
A privilege escalation flaw was found in Ceph
7.5
CVE-2024-47866
RGW DoS attack with empty HTTP header in S3 object copy
7.5
CVE-2018-16889
Ceph does not properly sanitize encryption keys in debug logging for v4 auth
7.5
CVE-2018-1128
It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack