Every CVE Search/ Get API key

CVE-2017-7519

In Ceph, a format string flaw was found in the way libradosstriper parses input from user. A user...

2.3 LowFix available

In Ceph, a format string flaw was found in the way libradosstriper parses input from user. A user could crash an application or service using the libradosstriper library.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.52%Down 0.3 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 2.3

In Ceph, a format string flaw was found in the way libradosstriper parses input from user. A user could crash an application or service using the libradosstriper library.

Record
CVE-2017-7519
CVSS 3.0
2.3 LowCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-134
Updated
2026-11-02
EUVDEUVD-2017-16536 2.3

In Ceph, a format string flaw was found in the way libradosstriper parses input from user. A user could crash an application or service using the libradosstriper library.

Record
EUVD-2017-16536
CVSS 3.0
2.3 LowCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-03
GitHub AdvisoriesGHSA-ghfm-8rwr-p3hr 4.4

In Ceph, a format string flaw was found in the way libradosstriper parses input from user. A user...

In Ceph, a format string flaw was found in the way libradosstriper parses input from user. A user could crash an application or service using the libradosstriper library.

Record
GHSA-ghfm-8rwr-p3hr
CVSS 3.0
4.4 MediumCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-134
Updated
2026-11-02
NVD 2.3

In Ceph, a format string flaw was found in the way libradosstriper parses input from user. A user could crash an application or service using the libradosstriper library.

Record
CVE-2017-7519
CVSS 3.0
2.3 LowCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
CVSS 3.0
4.4 MediumCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
2.1 LowAV:L/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-134
Updated
2026-11-02
OSV 4.4

In Ceph, a format string flaw was found in the way libradosstriper parses input from user. A user could crash an application or service using the libradosstriper library.

Record
CVE-2017-7519
CVSS 3.0
4.4 MediumCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2017-7519 4.4

In Ceph, a format string flaw was found in the way libradosstriper parses input from user. A user could crash an application or service using the libradosstriper library.

Record
DEBIAN-CVE-2017-7519
CVSS 3.0
4.4 MediumCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2017-7519 4.4

In Ceph, a format string flaw was found in the way libradosstriper parses input from user. A user could crash an application or service using the libradosstriper library.

Record
UBUNTU-CVE-2017-7519
CVSS 3.0
4.4 MediumCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CVSS 3.0
2.3 LowCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVSUSE-SU-2017:2922-1 No score

Security update for ceph

CEPH was updated to version 10.2.10, which brings several fixes and enhancements.

Upstream 10.2.10 release summary can be found at: https://ceph.com/releases/v10-2-10-jewel-released/

Security issues fixed:

  • CVE-2017-7519: libradosstriper processed arbitrary printf placeholders in user input (bsc#1043767)

Non-security issues fixed:

  • Add explicit Before=ceph.target to systemd service file. (bsc#1042973)
  • ceph-disk omits '--runtime' when enabling ceph-osd@$ID.service units. (bsc#1051598, bsc#1056536)
  • Make it possible to customize ceph-disk's timeout and set default to 3h. (bsc#1051432)
  • Move ceph-disk from ceph-common to ceph-base.
Record
SUSE-SU-2017:2922-1
Updated
2026-11-02
OSVSUSE-SU-2017:3171-1 No score

Security update for ceph

This update provides Ceph 10.2.10, which brings fixes and enhancements:

This security issue was fixed:

  • CVE-2017-7519: libradosstriper processes arbitrary printf placeholders in user input. (bsc#1043767)
  • CVE-2016-9579: Do not abort RGW server when accepting a CORS request with short origin. (bsc#1014986)

These non-security issues were fixed:

  • common: Add rdbmap to ceph-common. (bsc#1029482)
  • tools/rados: Default to include clone objects when executing 'cache-flush-evict-all'. (bsc#1003891)
  • mon, ceph-disk: Add lockbox permissions to bootstrap-osd. (bsc#1008435)
  • ceph_volume_client: Fix _recover_auth_meta() method. (bsc#1008501)
  • systemd/ceph-disk: Reduce ceph-disk flock contention. (bsc#1012100)
  • doc: Add verbiage to rbdmap manpage. (bsc#1015748)
  • doc: Add Install section to systemd rbdmap.service file. (bsc#1015748)
  • ceph systemd dependencies are wrong (bsc#1042973)
  • ceph-disk omits '--runtime' when enabling ceph-osd units (was: ERROR: unable to open OSD superblock) (bsc#1051598)
  • SES4: 23 osd's are down after patching node. (bsc#1056536)
  • Invalid error code returned by MDS is causing a kernel client WARNING (bsc#1028109)
  • systemctl stop rbdmap unmaps ALL rbds and not just the ones in /etc/ceph/rbdmap (bsc#1024691)
  • documentation: man crushtool does not cover the '--show-mappings' parameter (bsc#1033786)
  • swift | This returns with HTTP/1.1 401 Unauthorized (bsc#1015371)
  • OSDs fail to start after server reboot (bsc#1025643)
  • 'ceph-deploy mds destroy' not implemented (bsc#970642)
Record
SUSE-SU-2017:3171-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ceph
Debian:12
 before 12.2.8+dfsg1-1
12.2.8+dfsg1-1
ceph
Debian:13
 before 12.2.8+dfsg1-1
12.2.8+dfsg1-1
ceph
Debian:14
 before 12.2.8+dfsg1-1
12.2.8+dfsg1-1
ceph
Debian:9
 before 10.2.11-1, plus listed versions
10.2.5-7.210.2.7-0exp1
10.2.11-1
ceph
SUSE:Enterprise Storage 4
 before 10.2.10+git.1507616349.698469bd8d-12.6.1
10.2.10+git.1507616349.698469bd8d-12.6.1
ceph-test
SUSE:Enterprise Storage 4
 before 10.2.10+git.1507616349.698469bd8d-12.6.1
10.2.10+git.1507616349.698469bd8d-12.6.1
ceph
SUSE:Enterprise Storage 3
 before 10.2.10+git.1510313171.6d5f0aeac1-13.7.3
10.2.10+git.1510313171.6d5f0aeac1-13.7.3
ceph-test
SUSE:Enterprise Storage 3
 before 10.2.10+git.1510313171.6d5f0aeac1-13.7.2
10.2.10+git.1510313171.6d5f0aeac1-13.7.2

History

History
RecordedChangedSources
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-7519 is a low vulnerability (CVSS 2.3) in [unknown] Ceph, published November 2, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.52%, the 44th percentile. Fixed in ceph 12.2.8+dfsg1-1.

References

Show 24 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open