{"id":"CVE-2017-7519","aliases":["DEBIAN-CVE-2017-7519","DSA-4339-1","EUVD-2017-16536","GHSA-ghfm-8rwr-p3hr","SUSE-SU-2017:2922-1","SUSE-SU-2017:3171-1","UBUNTU-CVE-2017-7519"],"status":"published","title":"In Ceph, a format string flaw was found in the way libradosstriper parses input from user. A user...","description":"In Ceph, a format string flaw was found in the way libradosstriper parses input from user. A user could crash an application or service using the libradosstriper library.","severity":{"version":"3.0","score":2.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.0052,"percentile":0.44461,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-134"],"published":"2017-11-02T12:09:07Z","modified":"2026-09-01T20:03:50Z","fixes":[{"ecosystem":"Debian:12","package":"ceph","fixed_in":["12.2.8+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ceph","fixed_in":["12.2.8+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ceph","fixed_in":["12.2.8+dfsg1-1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 4","package":"ceph","fixed_in":["10.2.10+git.1507616349.698469bd8d-12.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 4","package":"ceph-test","fixed_in":["10.2.10+git.1507616349.698469bd8d-12.6.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.8+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.8+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.8+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2.11-1"}]}],"versions":["10.2.5-7.2","10.2.7-0exp1"],"bundled":4},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2.10+git.1507616349.698469bd8d-12.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"ceph-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2.10+git.1507616349.698469bd8d-12.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 3","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2.10+git.1510313171.6d5f0aeac1-13.7.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 3","package":"ceph-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2.10+git.1510313171.6d5f0aeac1-13.7.2"}]}],"bundled":2}],"products":[{"vendor":"[unknown]","product":"ceph"},{"vendor":"ceph","product":"ceph"},{"vendor":"debian","product":"debian_linux"}],"references":[{"url":"http://www.securityfocus.com/bid/99075","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://www.debian.org/security/2018/dsa-4339","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7519","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Issue Tracking","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-7519"},{"url":"https://github.com/advisories/GHSA-ghfm-8rwr-p3hr"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-7519","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172922-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1042973","tags":["report"]},{"url":"https://bugzilla.suse.com/1043767","tags":["report"]},{"url":"https://bugzilla.suse.com/1051432","tags":["report"]},{"url":"https://bugzilla.suse.com/1051598","tags":["report"]},{"url":"https://bugzilla.suse.com/1056536","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7519","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20173171-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1003891","tags":["report"]},{"url":"https://bugzilla.suse.com/1008435","tags":["report"]},{"url":"https://bugzilla.suse.com/1008501","tags":["report"]},{"url":"https://bugzilla.suse.com/1012100","tags":["report"]},{"url":"https://bugzilla.suse.com/1014986","tags":["report"]},{"url":"https://bugzilla.suse.com/1015371","tags":["report"]},{"url":"https://bugzilla.suse.com/1015748","tags":["report"]},{"url":"https://bugzilla.suse.com/1024691","tags":["report"]},{"url":"https://bugzilla.suse.com/1025643","tags":["report"]},{"url":"https://bugzilla.suse.com/1028109","tags":["report"]},{"url":"https://bugzilla.suse.com/1029482","tags":["report"]},{"url":"https://bugzilla.suse.com/1033786","tags":["report"]},{"url":"https://bugzilla.suse.com/970642","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9579","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-7519","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-7519","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-7519","description":"In Ceph, a format string flaw was found in the way libradosstriper parses input from user. A user could crash an application or service using the libradosstriper library.","status":"published","published":"2018-07-27T14:00:00Z","modified":"2024-08-05T16:04:11.82Z","cvss":[{"version":"3.0","score":2.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-134"],"updated_at":"2026-11-02T14:33:20.488433Z"}],"euvd":[{"id":"EUVD-2017-16536","description":"In Ceph, a format string flaw was found in the way libradosstriper parses input from user. A user could crash an application or service using the libradosstriper library.","status":"published","published":"2018-07-27T14:00:00Z","modified":"2024-08-05T16:04:11Z","cvss":[{"version":"3.0","score":2.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-03T02:39:08.024596Z"}],"ghsa":[{"id":"GHSA-ghfm-8rwr-p3hr","title":"In Ceph, a format string flaw was found in the way libradosstriper parses input from user. A user...","description":"In Ceph, a format string flaw was found in the way libradosstriper parses input from user. A user could crash an application or service using the libradosstriper library.","status":"published","published":"2022-05-13T01:36:19Z","modified":"2023-02-01T05:08:57Z","cvss":[{"version":"3.0","score":4.4,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-134"],"updated_at":"2026-11-02T14:50:53.78471Z"}],"nvd":[{"id":"CVE-2017-7519","description":"In Ceph, a format string flaw was found in the way libradosstriper parses input from user. A user could crash an application or service using the libradosstriper library.","status":"published","published":"2018-07-27T14:29:00.253Z","modified":"2026-06-17T01:24:30.897Z","cvss":[{"version":"3.0","score":2.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"secondary"},{"version":"3.0","score":4.4,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:N/I:N/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-134"],"updated_at":"2026-11-02T14:04:18.679411Z"}],"osv":[{"id":"CVE-2017-7519","description":"In Ceph, a format string flaw was found in the way libradosstriper parses input from user. A user could crash an application or service using the libradosstriper library.","status":"published","published":"2018-07-27T14:29:00.253Z","modified":"2026-03-14T14:30:29.283512Z","cvss":[{"version":"3.0","score":4.4,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:06.412595Z"},{"id":"DEBIAN-CVE-2017-7519","description":"In Ceph, a format string flaw was found in the way libradosstriper parses input from user. A user could crash an application or service using the libradosstriper library.","status":"published","published":"2018-07-27T14:29:00.253Z","modified":"2026-09-01T20:03:50.122722174Z","cvss":[{"version":"3.0","score":4.4,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:29.412243Z"},{"id":"UBUNTU-CVE-2017-7519","description":"In Ceph, a format string flaw was found in the way libradosstriper parses input from user. A user could crash an application or service using the libradosstriper library.","status":"withdrawn","published":"2018-07-27T14:29:00Z","modified":"2025-07-16T07:18:28.377392Z","cvss":[{"version":"3.0","score":4.4,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.0","score":2.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:54:15.773974Z"},{"id":"DSA-4339-1","title":"ceph - security update","status":"published","published":"2018-11-13T00:00:00Z","modified":"2026-03-09T02:10:26.047373Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"SUSE-SU-2017:2922-1","title":"Security update for ceph","description":"CEPH was updated to version 10.2.10, which brings several fixes and enhancements.\n\nUpstream 10.2.10 release summary can be found at: https://ceph.com/releases/v10-2-10-jewel-released/\n\nSecurity issues fixed:\n\n- CVE-2017-7519: libradosstriper processed arbitrary printf placeholders in user input (bsc#1043767)\n\nNon-security issues fixed:\n\n- Add explicit Before=ceph.target to systemd service file. (bsc#1042973)\n- ceph-disk omits '--runtime' when enabling ceph-osd@$ID.service units. (bsc#1051598, bsc#1056536)\n- Make it possible to customize ceph-disk's timeout and set default to 3h. (bsc#1051432)\n- Move ceph-disk from ceph-common to ceph-base.\n","status":"published","published":"2017-11-02T12:09:07Z","modified":"2026-02-04T02:15:26.604335Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2017:3171-1","title":"Security update for ceph","description":"\nThis update provides Ceph 10.2.10, which brings fixes and enhancements:\n\nThis security issue was fixed:\n\n- CVE-2017-7519: libradosstriper processes arbitrary printf placeholders in user input. (bsc#1043767)\n- CVE-2016-9579: Do not abort RGW server when accepting a CORS request with short origin. (bsc#1014986)\n\nThese non-security issues were fixed:\n\n- common: Add rdbmap to ceph-common. (bsc#1029482)\n- tools/rados: Default to include clone objects when executing 'cache-flush-evict-all'. (bsc#1003891)\n- mon, ceph-disk: Add lockbox permissions to bootstrap-osd. (bsc#1008435)\n- ceph_volume_client: Fix _recover_auth_meta() method. (bsc#1008501)\n- systemd/ceph-disk: Reduce ceph-disk flock contention. (bsc#1012100)\n- doc: Add verbiage to rbdmap manpage. (bsc#1015748)\n- doc: Add Install section to systemd rbdmap.service file. (bsc#1015748)\n- ceph systemd dependencies are wrong (bsc#1042973)\n- ceph-disk omits '--runtime' when enabling ceph-osd units (was: ERROR: unable to open OSD superblock) (bsc#1051598)\n- SES4: 23 osd's are down after patching node. (bsc#1056536)\n- Invalid error code returned by MDS is causing a kernel client WARNING (bsc#1028109)\n- systemctl stop rbdmap unmaps ALL rbds and not just the ones in /etc/ceph/rbdmap (bsc#1024691)\n- documentation: man crushtool does not cover the '--show-mappings' parameter (bsc#1033786)\n- swift | This returns with HTTP/1.1 401 Unauthorized (bsc#1015371)\n- OSDs fail to start after server reboot (bsc#1025643)\n- 'ceph-deploy mds destroy' not implemented (bsc#970642)\n","status":"published","published":"2017-12-01T10:31:17Z","modified":"2026-02-04T02:27:13.405763Z","updated_at":"2026-11-02T15:53:44.209561Z"}]}}