{"id":"CVE-2019-3821","aliases":["EUVD-2019-13444","GHSA-24mx-5rm6-qcm5","SUSE-SU-2019:2049-1","UBUNTU-CVE-2019-3821","USN-4035-1","openSUSE-SU-2024:10676-1"],"status":"published","title":"A flaw was found in the way civetweb frontend was handling requests for ceph RGW server with SSL...","description":"A flaw was found in the way civetweb frontend was handling requests for ceph RGW server with SSL enabled. An unauthenticated attacker could create multiple connections to ceph RADOS gateway to exhaust file descriptors for ceph-radosgw service resulting in a remote denial of service.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.02946,"percentile":0.87252,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-772"],"published":"2019-03-27T00:00:00Z","modified":"2026-06-17T02:35:39Z","affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.1.468+g994fd9e0cc-3.3.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.1.468+g994fd9e0cc-3.3.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2.11-0ubuntu0.16.04.2"}]}],"versions":["0.94.3-0ubuntu2","0.94.5-0ubuntu1","9.2.0-0ubuntu3","9.2.0-0ubuntu4","9.2.0-0ubuntu5","9.2.0-0ubuntu6","10.0.2-0ubuntu1","10.0.3-0ubuntu1","10.0.5-0ubuntu1","10.1.0-0ubuntu1","10.1.1-0ubuntu1","10.1.2-0ubuntu1","10.2.0-0ubuntu0.16.04.1","10.2.0-0ubuntu0.16.04.2","10.2.2-0ubuntu0.16.04.2","10.2.3-0ubuntu0.16.04.2","10.2.5-0ubuntu0.16.04.1","10.2.6-0ubuntu0.16.04.1","10.2.7-0ubuntu0.16.04.1","10.2.9-0ubuntu0.16.04.1","10.2.10-0ubuntu0.16.04.1","10.2.11-0ubuntu0.16.04.1"],"bundled":4}],"products":[{"vendor":"[unknown]","product":"ceph"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"ceph","product":"ceph"},{"vendor":"ceph","product":"civetweb"}],"references":[{"url":"https://usn.ubuntu.com/4035-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3821","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory"]},{"url":"https://github.com/ceph/civetweb/pull/33","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-3821"},{"url":"https://usn.ubuntu.com/4035-1"},{"url":"https://github.com/advisories/GHSA-24mx-5rm6-qcm5"},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192049-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1121567","tags":["report"]},{"url":"https://bugzilla.suse.com/1123360","tags":["report"]},{"url":"https://bugzilla.suse.com/1124957","tags":["report"]},{"url":"https://bugzilla.suse.com/1125080","tags":["report"]},{"url":"https://bugzilla.suse.com/1125899","tags":["report"]},{"url":"https://bugzilla.suse.com/1131984","tags":["report"]},{"url":"https://bugzilla.suse.com/1132396","tags":["report"]},{"url":"https://bugzilla.suse.com/1133139","tags":["report"]},{"url":"https://bugzilla.suse.com/1133461","tags":["report"]},{"url":"https://bugzilla.suse.com/1135030","tags":["report"]},{"url":"https://bugzilla.suse.com/1135219","tags":["report"]},{"url":"https://bugzilla.suse.com/1135221","tags":["report"]},{"url":"https://bugzilla.suse.com/1135388","tags":["report"]},{"url":"https://bugzilla.suse.com/1136110","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16889","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3821","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-3821","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4035-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-3821","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14662","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-16846","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-16889","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10736","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1759","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1760","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20288","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3509","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3524","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3531","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-3821","description":"A flaw was found in the way civetweb frontend was handling requests for ceph RGW server with SSL enabled. An unauthenticated attacker could create multiple connections to ceph RADOS gateway to exhaust file descriptors for ceph-radosgw service resulting in a remote denial of service.","status":"published","published":"2019-03-27T12:22:00Z","modified":"2024-08-04T19:19:18.564Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-772"],"updated_at":"2026-11-02T14:20:23.048861Z"}],"euvd":[{"id":"EUVD-2019-13444","description":"A flaw was found in the way civetweb frontend was handling requests for ceph RGW server with SSL enabled. An unauthenticated attacker could create multiple connections to ceph RADOS gateway to exhaust file descriptors for ceph-radosgw service resulting in a remote denial of service.","status":"published","published":"2019-03-27T12:22:00Z","modified":"2024-08-04T19:19:18Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T03:06:54.939848Z"}],"ghsa":[{"id":"GHSA-24mx-5rm6-qcm5","title":"A flaw was found in the way civetweb frontend was handling requests for ceph RGW server with SSL...","description":"A flaw was found in the way civetweb frontend was handling requests for ceph RGW server with SSL enabled. An unauthenticated attacker could create multiple connections to ceph RADOS gateway to exhaust file descriptors for ceph-radosgw service resulting in a remote denial of service.","status":"published","published":"2022-05-13T01:13:34Z","modified":"2024-11-19T21:31:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-772"],"updated_at":"2026-11-02T14:58:53.124405Z"}],"nvd":[{"id":"CVE-2019-3821","description":"A flaw was found in the way civetweb frontend was handling requests for ceph RGW server with SSL enabled. An unauthenticated attacker could create multiple connections to ceph RADOS gateway to exhaust file descriptors for ceph-radosgw service resulting in a remote denial of service.","status":"published","published":"2019-03-27T13:29:01.507Z","modified":"2026-06-17T02:35:39.493Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-772"],"updated_at":"2026-11-02T14:05:09.523883Z"}],"osv":[{"id":"UBUNTU-CVE-2019-3821","description":"A flaw was found in the way civetweb frontend was handling requests for ceph RGW server with SSL enabled. An unauthenticated attacker could create multiple connections to ceph RADOS gateway to exhaust file descriptors for ceph-radosgw service resulting in a remote denial of service.","status":"withdrawn","published":"2019-03-27T00:00:00Z","modified":"2026-02-04T03:03:22.987381Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:21.213407Z"},{"id":"openSUSE-SU-2024:10676-1","title":"ceph-16.2.6.45+g8fda9838398-1.1 on GA media","description":"These are all security issues fixed in the ceph-16.2.6.45+g8fda9838398-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:26:40.49272Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2019:2049-1","title":"Security update for ceph","description":"This update for ceph fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-3821: civetweb: fix file descriptor leak (bsc#1125080)\n- CVE-2018-16889: rgw: sanitize customer encryption keys from log output in v4 auth (bsc#1121567)\n\nNon-security issues fixed:\n\n- install grafana dashboards world readable (bsc#1136110)\n- upgrade results in cluster outage (bsc#1132396)\n- ceph status reports 'HEALTH_WARN 3 monitors have not enabled msgr2' (bsc#1124957)\n-  Dashboard: Opening tcmu-runner perf counters results in a 404 (bsc#1135388)\n- RadosGW stopped expiring objects (bsc#1133139)\n- Ceph does not recover when rebuilding every OSD  (bsc#1133461)\n","status":"published","published":"2019-08-05T15:56:32Z","modified":"2026-02-04T04:38:28.880616Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"USN-4035-1","title":"ceph vulnerabilities","description":"It was discovered that Ceph incorrectly handled read only permissions. An\nauthenticated attacker could use this issue to obtain dm-crypt encryption\nkeys. This issue only affected Ubuntu 16.04 LTS. (CVE-2018-14662)\n\nIt was discovered that Ceph incorrectly handled certain OMAPs holding\nbucket indices. An authenticated attacker could possibly use this issue to\ncause a denial of service. This issue only affected Ubuntu 16.04 LTS.\n(CVE-2018-16846)\n\nIt was discovered that Ceph incorrectly sanitized certain debug logs. A\nlocal attacker could possibly use this issue to obtain encryption key\ninformation. This issue was only addressed in Ubuntu 18.10 and Ubuntu\n19.04. (CVE-2018-16889)\n\nIt was discovered that Ceph incorrectly handled certain civetweb requests.\nA remote attacker could possibly use this issue to consume resources,\nleading to a denial of service. This issue only affected Ubuntu 18.10 and\nUbuntu 19.04. (CVE-2019-3821)\n","status":"published","published":"2019-06-25T11:40:06Z","modified":"2026-04-22T09:58:04.824743Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}