{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2015-10-19T00:00:00", "descriptions": [{"lang": "en", "value": "CRLF injection vulnerability in the Ceph Object Gateway (aka radosgw or RGW) in Ceph before 0.94.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted bucket name."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2015-12-03T19:57:01", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "http://tracker.ceph.com/issues/12537"}, {"name": "RHSA-2015:2512", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2015:2512"}, {"name": "[Ceph-announce] 20151019 v0.94.4 Hammer released", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://lists.ceph.com/pipermail/ceph-announce-ceph.com/2015-October/000034.html"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T06:41:09.165Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://tracker.ceph.com/issues/12537"}, {"name": "RHSA-2015:2512", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2015:2512"}, {"name": "[Ceph-announce] 20151019 v0.94.4 Hammer released", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://lists.ceph.com/pipermail/ceph-announce-ceph.com/2015-October/000034.html"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2015-5245", "datePublished": "2015-12-03T20:00:00", "dateReserved": "2015-07-01T00:00:00", "dateUpdated": "2024-08-06T06:41:09.165Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:ceph:*:*:*:*:*:*:*:*", "matchCriteriaId": "484C877F-D9BB-4D8B-B8A9-2052E65ECE67", "versionEndIncluding": "0.94.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "CRLF injection vulnerability in the Ceph Object Gateway (aka radosgw or RGW) in Ceph before 0.94.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted bucket name."}, {"lang": "es", "value": "Vulnerabilidad de inyecci\u00f3n CRLF en la Ceph Object Gateway (tambi\u00e9n conocida como radosgw o RGW) en Ceph en versiones anteriores a 0.94.4 permite a atacantes remotos inyectar cabeceras HTTP arbitrarias y llevar a cabo ataques de separaci\u00f3n de respuesta HTTP a trav\u00e9s de un nombre de contenedor manipulado."}], "evaluatorComment": "<a href=\"http://cwe.mitre.org/data/definitions/113.html\">CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')</a>", "id": "CVE-2015-5245", "lastModified": "2025-04-12T10:46:40.837", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2015-12-03T20:59:05.223", "references": [{"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "http://lists.ceph.com/pipermail/ceph-announce-ceph.com/2015-October/000034.html"}, {"source": "secalert@redhat.com", "url": "http://tracker.ceph.com/issues/12537"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2015:2512"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://lists.ceph.com/pipermail/ceph-announce-ceph.com/2015-October/000034.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://tracker.ceph.com/issues/12537"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://access.redhat.com/errata/RHSA-2015:2512"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "babeltrace-0:1.2.4-3.el7cp", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "calamari-server-0:1.3-11.el7cp", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "ceph-1:0.94.3-3.el7cp", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "ceph-deploy-0:1.5.27.3-1.el7cp", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "ceph-puppet-modules-0:0.1.1-1.el7cp", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "facter-1:1.7.6-2.1.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "foreman-0:1.7.2.33-1.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "foreman-installer-1:1.7.5-2.el7cp", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "foreman-proxy-0:1.7.2.5-1.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "foreman-selinux-0:1.7.2.13-1.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "hiera-0:1.3.1-2.el7", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "ipxe-0:20130517-7.1fm.gitc4bce43.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "lttng-tools-0:2.4.1-1.el7cp", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "lttng-ust-0:2.4.1-1.el7cp", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "puppet-0:3.6.2-4.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "radosgw-agent-0:1.2.3-1.el7cp", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "rhcs-installer-0:0.1.0-1.el7cp", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "ruby193-facter-0:1.6.18-5.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "ruby193-rubygem-ancestry-0:2.0.0-1.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "ruby193-rubygem-apipie-rails-0:0.2.5-1.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "ruby193-rubygem-audited-0:3.0.0-5.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "ruby193-rubygem-audited-activerecord-0:3.0.0-8.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "ruby193-rubygem-bundler_ext-0:0.3.0-6.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "ruby193-rubygem-deep_cloneable-0:2.0.0-4.el7", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "ruby193-rubygem-fast_gettext-0:0.8.0-13.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "ruby193-rubygem-foreigner-0:1.4.2-1.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "ruby193-rubygem-foreman_bootdisk-0:4.0.2.13-1.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "ruby193-rubygem-friendly_id-0:4.0.10.1-1.el7", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "ruby193-rubygem-gettext_i18n_rails-0:0.10.0-3.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "ruby193-rubygem-gettext_i18n_rails_js-0:0.0.8-3.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "ruby193-rubygem-i18n_data-0:0.2.7-5.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "ruby193-rubygem-ldap_fluff-0:0.3.2-1.el7", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "ruby193-rubygem-multi_json-0:1.8.2-4.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "ruby193-rubygem-net-ldap-0:0.3.1-3.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "ruby193-rubygem-oauth-0:0.4.7-8.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "ruby193-rubygem-passenger-0:4.0.18-19.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "ruby193-rubygem-pg-0:0.12.2-10.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "ruby193-rubygem-po_to_json-0:0.0.7-3.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "ruby193-rubygem-rabl-0:0.9.0-1.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "ruby193-rubygem-rest-client-0:1.6.7-1.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "ruby193-rubygem-ruby2ruby-0:2.0.1-9.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "ruby193-rubygem-ruby_parser-0:3.1.1-15.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "ruby193-rubygem-safemode-0:1.2.1-1.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "ruby193-rubygem-scoped_search-0:2.7.1-2.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "ruby193-rubygem-secure_headers-0:1.3.3-1.el7", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "ruby193-rubygem-sexp_processor-0:4.1.3-7.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "ruby193-rubygem-sprockets-0:2.10.1-3.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "ruby193-rubygem-uuidtools-0:2.1.3-6.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "ruby193-rubygem-validates_lengths_from_database-0:0.2.0-1.3.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "ruby193-rubygem-will_paginate-0:3.0.2-10.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "ruby193-ruby-wrapper-0:0.0.2-6.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "ruby-augeas-0:0.5.0-1.el7", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "rubygem-ansi-0:1.4.3-3.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "rubygem-apipie-bindings-0:0.0.11-1.el7", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "rubygem-awesome_print-0:1.0.2-12.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "rubygem-bundler_ext-0:0.3.0-7.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "rubygem-clamp-0:0.6.2-2.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "rubygem-ffi-0:1.4.0-3.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "rubygem-gssapi-0:1.1.2-4.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "rubygem-hashie-0:2.0.5-2.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "rubygem-highline-0:1.6.21-1.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "rubygem-kafo-0:0.6.5.9-1.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "rubygem-kafo_parsers-0:0.0.4.4-1.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "rubygem-little-plugger-0:1.1.3-17.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "rubygem-logging-0:1.8.1-26.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "rubygem-mime-types-0:1.19-7.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "rubygem-multi_json-0:1.8.2-4.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "rubygem-oauth-0:0.4.7-8.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "rubygem-passenger-0:4.0.18-19.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "rubygem-powerbar-0:1.0.11-8.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "rubygem-rack-1:1.4.1-13.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "rubygem-rack-protection-0:1.5.0-7.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "rubygem-rake-0:0.9.2.2-41.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "rubygem-rest-client-0:1.6.7-1.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "rubygem-rkerberos-0:0.1.2-3.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "rubygem-rubyipmi-0:0.10.0-1.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "rubygem-sinatra-1:1.3.6-27.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "rubygem-smart_proxy_discovery-0:1.0.2.1-1.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "rubygem-tilt-0:1.3.3-18.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "ruby-rgen-0:0.6.5-2.el7sat", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "ruby-shadow-0:1.4.1-21.el7", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2066", "cpe": "cpe:/a:redhat:ceph_storage:1.3::el7", "package": "userspace-rcu-0:0.7.9-2.el7rhgs", "product_name": "Red Hat Ceph Storage 1.3 for Red Hat Enterprise Linux 7", "release_date": "2015-11-23T00:00:00Z"}, {"advisory": "RHSA-2015:2512", "cpe": "cpe:/a:redhat:ceph_storage:1.3::ubuntu:14.04", "product_name": "Red Hat Ceph Storage 1.3 for Ubuntu", "release_date": "2015-11-23T00:00:00Z"}], "bugzilla": {"description": "Ceph: RGW returns requested bucket name raw in Bucket response header", "id": "1261606", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1261606"}, "csaw": false, "cvss": {"cvss_base_score": "5.5", "cvss_scoring_vector": "AV:N/AC:L/Au:S/C:N/I:P/A:P", "status": "verified"}, "cwe": "CWE-20", "details": ["CRLF injection vulnerability in the Ceph Object Gateway (aka radosgw or RGW) in Ceph before 0.94.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted bucket name.", "A feature in Ceph Object Gateway (RGW) allows to return a specific HTTP header that contains the name of a bucket that was accessed. It was found that the returned HTTP headers were not sanitized. An unauthenticated attacker could use this flaw to craft HTTP headers in responses that would confuse the load balancer residing in front of RGW, potentially resulting in a denial of service."], "name": "CVE-2015-5245", "package_state": [{"cpe": "cpe:/a:redhat:ceph_storage:1.2", "fix_state": "Will not fix", "package_name": "ceph", "product_name": "Red Hat Ceph Storage 1.2"}], "public_date": "2015-08-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2015-5245\nhttps://nvd.nist.gov/vuln/detail/CVE-2015-5245"], "threat_severity": "Moderate"}