CVE-2024-47866

Summary

Ceph is a distributed object, block, and file storage platform. In versions up to and including 19.2.3, using the argument x-amz-copy-source to put an object and specifying an empty string as its content leads to the RGW daemon crashing, resulting in a DoS attack. As of time of publication, no known patched versions exist.

Affected Software

Weaknesses

• CWE-20: CWE-20: Improper Input Validation

ADP Enrichment

CVE Program Container

Additional References

• http://www.openwall.com/lists/oss-security/2025/11/11/3

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: partial

Additional References

• https://github.com/ceph/ceph/security/advisories/GHSA-mgrm-g92q-f8h8

References

• https://github.com/ceph/ceph/security/advisories/GHSA-mgrm-g92q-f8h8

• ←Previous
• Next→