Every CVE Search/ Get API key

CVE-2019-19337

A flaw was found in Red Hat Ceph Storage version 3 in the way the Ceph RADOS Gateway daemon...

6.5 MediumFix available

A flaw was found in Red Hat Ceph Storage version 3 in the way the Ceph RADOS Gateway daemon handles S3 requests. An authenticated attacker can abuse this flaw by causing a remote denial of service by sending a specially crafted HTTP Content-Length header to the Ceph RADOS Gateway server.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.32%Up 0.7 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 6.5

A flaw was found in Red Hat Ceph Storage version 3 in the way the Ceph RADOS Gateway daemon handles S3 requests. An authenticated attacker can abuse this flaw by causing a remote denial of service by sending a specially crafted HTTP Content-Length header to the Ceph RADOS Gateway server.

Record
CVE-2019-19337
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-20
Updated
2026-11-02
EUVDEUVD-2019-8958 6.5

A flaw was found in Red Hat Ceph Storage version 3 in the way the Ceph RADOS Gateway daemon handles S3 requests. An authenticated attacker can abuse this flaw by causing a remote denial of service by sending a specially crafted HTTP Content-Length header to the Ceph RADOS Gateway server.

Record
EUVD-2019-8958
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-pg96-f95x-566r 6.5

A flaw was found in Red Hat Ceph Storage version 3 in the way the Ceph RADOS Gateway daemon...

A flaw was found in Red Hat Ceph Storage version 3 in the way the Ceph RADOS Gateway daemon handles S3 requests. An authenticated attacker can abuse this flaw by causing a remote denial of service by sending a specially crafted HTTP Content-Length header to the Ceph RADOS Gateway server.

Record
GHSA-pg96-f95x-566r
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-20
Updated
2026-11-02
NVD 6.5

A flaw was found in Red Hat Ceph Storage version 3 in the way the Ceph RADOS Gateway daemon handles S3 requests. An authenticated attacker can abuse this flaw by causing a remote denial of service by sending a specially crafted HTTP Content-Length header to the Ceph RADOS Gateway server.

Record
CVE-2019-19337
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
4.0 MediumAV:N/AC:L/Au:S/C:N/I:N/A:P
Weakness
CWE-20
Updated
2026-11-02
OSVRHSA-2019:4353 6.5

Red Hat Security Advisory: Red Hat Ceph Storage security, bug fix, and enhancement update

Record
RHSA-2019:4353
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ceph
Red Hat:ceph_storage:3::el7
 before 2:12.2.12-84.el7cp
2:12.2.12-84.el7cp
ceph-base
Red Hat:ceph_storage:3::el7
 before 2:12.2.12-84.el7cp
2:12.2.12-84.el7cp
ceph-common
Red Hat:ceph_storage:3::el7
 before 2:12.2.12-84.el7cp
2:12.2.12-84.el7cp
ceph-debuginfo
Red Hat:ceph_storage:3::el7
 before 2:12.2.12-84.el7cp
2:12.2.12-84.el7cp
ceph-mgr
Red Hat:ceph_storage:3::el7
 before 2:12.2.12-84.el7cp
2:12.2.12-84.el7cp
ceph-mon
Red Hat:ceph_storage:3::el7
 before 2:12.2.12-84.el7cp
2:12.2.12-84.el7cp
ceph-selinux
Red Hat:ceph_storage:3::el7
 before 2:12.2.12-84.el7cp
2:12.2.12-84.el7cp
ceph-test
Red Hat:ceph_storage:3::el7
 before 2:12.2.12-84.el7cp
2:12.2.12-84.el7cp
libcephfs-devel
Red Hat:ceph_storage:3::el7
 before 2:12.2.12-84.el7cp
2:12.2.12-84.el7cp
libcephfs2
Red Hat:ceph_storage:3::el7
 before 2:12.2.12-84.el7cp
2:12.2.12-84.el7cp
Show 19 moreShow less
Affected packages
PackageAffectedFixed
librados-devel
Red Hat:ceph_storage:3::el7
 before 2:12.2.12-84.el7cp
2:12.2.12-84.el7cp
librados2
Red Hat:ceph_storage:3::el7
 before 2:12.2.12-84.el7cp
2:12.2.12-84.el7cp
libradosstriper1
Red Hat:ceph_storage:3::el7
 before 2:12.2.12-84.el7cp
2:12.2.12-84.el7cp
librbd-devel
Red Hat:ceph_storage:3::el7
 before 2:12.2.12-84.el7cp
2:12.2.12-84.el7cp
librbd1
Red Hat:ceph_storage:3::el7
 before 2:12.2.12-84.el7cp
2:12.2.12-84.el7cp
librgw-devel
Red Hat:ceph_storage:3::el7
 before 2:12.2.12-84.el7cp
2:12.2.12-84.el7cp
librgw2
Red Hat:ceph_storage:3::el7
 before 2:12.2.12-84.el7cp
2:12.2.12-84.el7cp
python-cephfs
Red Hat:ceph_storage:3::el7
 before 2:12.2.12-84.el7cp
2:12.2.12-84.el7cp
python-rados
Red Hat:ceph_storage:3::el7
 before 2:12.2.12-84.el7cp
2:12.2.12-84.el7cp
python-rbd
Red Hat:ceph_storage:3::el7
 before 2:12.2.12-84.el7cp
2:12.2.12-84.el7cp
python-rgw
Red Hat:ceph_storage:3::el7
 before 2:12.2.12-84.el7cp
2:12.2.12-84.el7cp
ceph-osd
Red Hat:ceph_storage:3::el7
 before 2:12.2.12-84.el7cp
2:12.2.12-84.el7cp
ceph-ansible
Red Hat:ceph_storage:3::el7
 before 0:3.2.38-1.el7cp
0:3.2.38-1.el7cp
ceph-fuse
Red Hat:ceph_storage:3::el7
 before 2:12.2.12-84.el7cp
2:12.2.12-84.el7cp
ceph-mds
Red Hat:ceph_storage:3::el7
 before 2:12.2.12-84.el7cp
2:12.2.12-84.el7cp
ceph-radosgw
Red Hat:ceph_storage:3::el7
 before 2:12.2.12-84.el7cp
2:12.2.12-84.el7cp
cephmetrics
Red Hat:ceph_storage:3::el7
 before 0:2.0.9-1.el7cp
0:2.0.9-1.el7cp
cephmetrics-ansible
Red Hat:ceph_storage:3::el7
 before 0:2.0.9-1.el7cp
0:2.0.9-1.el7cp
rbd-mirror
Red Hat:ceph_storage:3::el7
 before 2:12.2.12-84.el7cp
2:12.2.12-84.el7cp

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-19337 is a medium vulnerability (CVSS 6.5) in Red Hat Ceph Storage, published December 23, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.32%, the 70th percentile. Fixed in ceph 2:12.2.12-84.el7cp.

References

Show 33 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open