{"id":"CVE-2018-7262","aliases":["EUVD-2018-18998","GHSA-8gpf-89wg-vgwp","RHSA-2018:0546","SUSE-SU-2018:1417-1","SUSE-SU-2018:1576-1","SUSE-SU-2018:2299-1"],"status":"published","title":"In Ceph before 12.2.3 and 13.x through 13.0.1, the rgw_civetweb.cc RGWCivetWeb::init_env function...","description":"In Ceph before 12.2.3 and 13.x through 13.0.1, the rgw_civetweb.cc RGWCivetWeb::init_env function in radosgw doesn't handle malformed HTTP headers properly, allowing for denial of service.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02869,"percentile":0.86883,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2018-03-19T21:00:00Z","modified":"2026-10-20T10:49:56Z","fixes":[{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph","fixed_in":["2:12.2.1-46.el7cp"],"sources":["osv"]},{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-base","fixed_in":["2:12.2.1-46.el7cp"],"sources":["osv"]},{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-common","fixed_in":["2:12.2.1-46.el7cp"],"sources":["osv"]},{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-debuginfo","fixed_in":["2:12.2.1-46.el7cp"],"sources":["osv"]},{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-mgr","fixed_in":["2:12.2.1-46.el7cp"],"sources":["osv"]},{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-mon","fixed_in":["2:12.2.1-46.el7cp"],"sources":["osv"]},{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-selinux","fixed_in":["2:12.2.1-46.el7cp"],"sources":["osv"]},{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-test","fixed_in":["2:12.2.1-46.el7cp"],"sources":["osv"]},{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"libcephfs-devel","fixed_in":["2:12.2.1-46.el7cp"],"sources":["osv"]},{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"libcephfs2","fixed_in":["2:12.2.1-46.el7cp"],"sources":["osv"]},{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"librados-devel","fixed_in":["2:12.2.1-46.el7cp"],"sources":["osv"]},{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"librados2","fixed_in":["2:12.2.1-46.el7cp"],"sources":["osv"]},{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"libradosstriper1","fixed_in":["2:12.2.1-46.el7cp"],"sources":["osv"]},{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"librbd-devel","fixed_in":["2:12.2.1-46.el7cp"],"sources":["osv"]},{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"librbd1","fixed_in":["2:12.2.1-46.el7cp"],"sources":["osv"]},{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"librgw-devel","fixed_in":["2:12.2.1-46.el7cp"],"sources":["osv"]},{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"librgw2","fixed_in":["2:12.2.1-46.el7cp"],"sources":["osv"]},{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"python-cephfs","fixed_in":["2:12.2.1-46.el7cp"],"sources":["osv"]},{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"python-rados","fixed_in":["2:12.2.1-46.el7cp"],"sources":["osv"]},{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"python-rbd","fixed_in":["2:12.2.1-46.el7cp"],"sources":["osv"]},{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"python-rgw","fixed_in":["2:12.2.1-46.el7cp"],"sources":["osv"]},{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-osd","fixed_in":["2:12.2.1-46.el7cp"],"sources":["osv"]},{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-fuse","fixed_in":["2:12.2.1-46.el7cp"],"sources":["osv"]},{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-mds","fixed_in":["2:12.2.1-46.el7cp"],"sources":["osv"]},{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-radosgw","fixed_in":["2:12.2.1-46.el7cp"],"sources":["osv"]},{"ecosystem":"Red Hat:ceph_storage:3::el7","package":"rbd-mirror","fixed_in":["2:12.2.1-46.el7cp"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 5","package":"ceph","fixed_in":["12.2.5+git.1524775272.5e7ea8cf03-2.13.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.1-46.el7cp"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.1-46.el7cp"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.1-46.el7cp"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.1-46.el7cp"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-mgr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.1-46.el7cp"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-mon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.1-46.el7cp"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.1-46.el7cp"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.1-46.el7cp"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"libcephfs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.1-46.el7cp"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"libcephfs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.1-46.el7cp"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"librados-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.1-46.el7cp"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"librados2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.1-46.el7cp"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"libradosstriper1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.1-46.el7cp"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"librbd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.1-46.el7cp"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"librbd1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.1-46.el7cp"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"librgw-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.1-46.el7cp"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"librgw2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.1-46.el7cp"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"python-cephfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.1-46.el7cp"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"python-rados","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.1-46.el7cp"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"python-rbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.1-46.el7cp"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"python-rgw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.1-46.el7cp"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-osd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.1-46.el7cp"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.1-46.el7cp"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-mds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.1-46.el7cp"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"ceph-radosgw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.1-46.el7cp"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:3::el7","package":"rbd-mirror","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.2.1-46.el7cp"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.5+git.1524775272.5e7ea8cf03-2.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.5+git.1524775272.5e7ea8cf03-2.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.5+git.1524775272.5e7ea8cf03-2.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.5+git.1524775272.5e7ea8cf03-2.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.5+git.1524775272.5e7ea8cf03-2.13.3"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2.11+git.1531487710.3a12911a2e-12.14.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"ceph-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2.11+git.1531487710.3a12911a2e-12.14.2"}]}],"bundled":4}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"redhat","product":"ceph"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2018:0546","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/ceph/ceph/pull/20488","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"http://tracker.ceph.com/issues/23039","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Vendor Advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1546611","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","report"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0548","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/74VI6EPZ6LD2O4JJXJBTYQ4U4VUO2ZDO/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-7262","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/74VI6EPZ6LD2O4JJXJBTYQ4U4VUO2ZDO/"},{"url":"https://github.com/advisories/GHSA-8gpf-89wg-vgwp"},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1546610","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_0546.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-7262","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-7262","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181417-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1051598","tags":["report"]},{"url":"https://bugzilla.suse.com/1054061","tags":["report"]},{"url":"https://bugzilla.suse.com/1056125","tags":["report"]},{"url":"https://bugzilla.suse.com/1056967","tags":["report"]},{"url":"https://bugzilla.suse.com/1059458","tags":["report"]},{"url":"https://bugzilla.suse.com/1060904","tags":["report"]},{"url":"https://bugzilla.suse.com/1061461","tags":["report"]},{"url":"https://bugzilla.suse.com/1063014","tags":["report"]},{"url":"https://bugzilla.suse.com/1066182","tags":["report"]},{"url":"https://bugzilla.suse.com/1066502","tags":["report"]},{"url":"https://bugzilla.suse.com/1067088","tags":["report"]},{"url":"https://bugzilla.suse.com/1067119","tags":["report"]},{"url":"https://bugzilla.suse.com/1067705","tags":["report"]},{"url":"https://bugzilla.suse.com/1070357","tags":["report"]},{"url":"https://bugzilla.suse.com/1071386","tags":["report"]},{"url":"https://bugzilla.suse.com/1074301","tags":["report"]},{"url":"https://bugzilla.suse.com/1079076","tags":["report"]},{"url":"https://bugzilla.suse.com/1080788","tags":["report"]},{"url":"https://bugzilla.suse.com/1081379","tags":["report"]},{"url":"https://bugzilla.suse.com/1081600","tags":["report"]},{"url":"https://bugzilla.suse.com/1086340","tags":["report"]},{"url":"https://bugzilla.suse.com/1087269","tags":["report"]},{"url":"https://bugzilla.suse.com/1087493","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7262","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181576-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182299-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1072512","tags":["report"]},{"url":"https://bugzilla.suse.com/1080112","tags":["report"]},{"url":"https://bugzilla.suse.com/1096748","tags":["report"]},{"url":"https://bugzilla.suse.com/1099162","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1129","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-7262","description":"In Ceph before 12.2.3 and 13.x through 13.0.1, the rgw_civetweb.cc RGWCivetWeb::init_env function in radosgw doesn't handle malformed HTTP headers properly, allowing for denial of service.","status":"published","published":"2018-03-19T21:00:00Z","modified":"2024-08-05T06:24:11.701Z","updated_at":"2026-11-02T14:35:09.908186Z"}],"euvd":[{"id":"EUVD-2018-18998","description":"In Ceph before 12.2.3 and 13.x through 13.0.1, the rgw_civetweb.cc RGWCivetWeb::init_env function in radosgw doesn't handle malformed HTTP headers properly, allowing for denial of service.","status":"published","published":"2018-03-19T21:00:00Z","modified":"2024-08-05T06:24:11Z","updated_at":"2026-11-03T02:40:06.159235Z"}],"ghsa":[{"id":"GHSA-8gpf-89wg-vgwp","title":"In Ceph before 12.2.3 and 13.x through 13.0.1, the rgw_civetweb.cc RGWCivetWeb::init_env function...","description":"In Ceph before 12.2.3 and 13.x through 13.0.1, the rgw_civetweb.cc RGWCivetWeb::init_env function in radosgw doesn't handle malformed HTTP headers properly, allowing for denial of service.","status":"published","published":"2022-05-14T01:37:01Z","modified":"2023-02-02T05:03:58Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:51:45.826629Z"}],"nvd":[{"id":"CVE-2018-7262","description":"In Ceph before 12.2.3 and 13.x through 13.0.1, the rgw_civetweb.cc RGWCivetWeb::init_env function in radosgw doesn't handle malformed HTTP headers properly, allowing for denial of service.","status":"published","published":"2018-03-19T21:29:01.003Z","modified":"2026-06-17T02:02:53.42Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:04:24.264003Z"}],"osv":[{"id":"CVE-2018-7262","description":"In Ceph before 12.2.3 and 13.x through 13.0.1, the rgw_civetweb.cc RGWCivetWeb::init_env function in radosgw doesn't handle malformed HTTP headers properly, allowing for denial of service.","status":"published","published":"2018-03-19T21:29:01.003Z","modified":"2026-10-20T10:49:56.535661984Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:09.74357Z"},{"id":"RHSA-2018:0546","title":"Red Hat Security Advisory: ceph security update","status":"published","published":"2024-09-13T19:48:17Z","modified":"2026-06-29T10:19:29Z","cvss":[{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"SUSE-SU-2018:1417-1","title":"Security update for ceph","description":"This update for ceph fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-7262: rgw: malformed http headers can crash rgw (bsc#1081379).\n- CVE-2017-16818: User reachable asserts allow for DoS (bsc#1063014).\n\nBug fixes:\n\n- bsc#1061461: OSDs keep generating coredumps after adding new OSD node to cluster.\n- bsc#1079076: RGW openssl fixes.\n- bsc#1067088: Upgrade to SES5 restarted all nodes, majority of OSDs aborts during start.\n- bsc#1056125: Some OSDs are down when doing performance testing on rbd image in EC Pool.\n- bsc#1087269: allow_ec_overwrites option not in command options list.\n- bsc#1051598: Fix mountpoint check for systemctl enable --runtime.\n- bsc#1070357: Zabbix mgr module doesn't recover from HEALTH_ERR.\n- bsc#1066502: After upgrading a single OSD from SES 4 to SES 5 the OSDs do not rejoin the cluster.\n- bsc#1067119: Crushtool decompile creates wrong device entries (device 20 device20) for not existing / deleted OSDs.\n- bsc#1060904: Loglevel misleading during keystone authentication.\n- bsc#1056967: Monitors goes down after pool creation on cluster with 120 OSDs.\n- bsc#1067705: Issues with RGW Multi-Site Federation between SES5 and RH Ceph Storage 2.\n- bsc#1059458: Stopping / restarting rados gateway as part of deepsea stage.4 executions causes core-dump of radosgw.\n- bsc#1087493: Commvault cannot reconnect to storage after restarting haproxy.\n- bsc#1066182: Container synchronization between two Ceph clusters failed.\n- bsc#1081600: Crash in civetweb/RGW.\n- bsc#1054061: NFS-GANESHA service failing while trying to list mountpoint on client.\n- bsc#1074301: OSDs keep aborting: SnapMapper failed asserts.\n- bsc#1086340: XFS metadata corruption on rbd-nbd mapped image with journaling feature enabled.\n- bsc#1080788: fsid mismatch when creating additional OSDs.\n- bsc#1071386: Metadata spill onto block.slow.\n","status":"published","published":"2018-06-07T13:10:58Z","modified":"2026-02-04T02:17:55.01326Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"SUSE-SU-2018:1576-1","title":"Security update for ceph","description":"\n  \nThis update for ceph to 12.2.5-407-g5e7ea8cf03 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2018-7262: The rgw_civetweb.cc RGWCivetWeb::init_env function in radosgw doesn't handle malformed HTTP headers properly, allowing for denial of service. rgw: make init env methods return an error (bsc#1081379)\n\nOther issues fixed:\n\n- osd: do not crash on empty snapset (bsc#1074301)\n- mon: add 'ceph osd pool get erasure allow_ec_overwrites' command (bsc#1087269)\n- journal: limit number of appends sent in one librados op (bsc#1086340)\n- RGW user stats fixes (bsc#1087493)\n- rgw openssl fixes (bsc#1079076, bsc#1081379)\n- rocksdb: fixes early metadata spill over to slow device in bluefs (bsc#1071386)\n- mon: reenable timer to send digest when paxos is temporarily inactive (bsc#1070357)\n- fsid mismatch when creating additional OSDs (bsc#1080788)\n- crash in civetweb/RGW (bsc#1081600) \n","status":"published","published":"2018-06-07T13:11:11Z","modified":"2026-02-04T03:42:22.056547Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"SUSE-SU-2018:2299-1","title":"Security update for ceph","description":"This update for ceph fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-10861: Fix ceph-mon authorization on OSD pool ops (bsc#1099162).\n- CVE-2018-1128: Fix cephx signature check bypass (bsc#1096748).\n- CVE-2018-1129: Fix cephx protocol vulnerability to replay attack (bsc#1096748).\n- CVE-2018-7262: Fix malformed http headers that can crash rgw (bsc#1081379).\n\nBug fixes:\n\n- bsc#1072512: multipart uploads are broken if the bucket has been resharded\n- bsc#1080112: rgw: user stats increased after bucket reshard\n- bsc#1086340: SES5: XFS metadata corruption on rbd-nbd mapped image with journaling feature enabled\n","status":"published","published":"2018-08-10T09:36:47Z","modified":"2025-05-02T04:07:26.834793Z","updated_at":"2026-11-02T15:53:44.972817Z"}]}}