Skip to content
Fencer Vulns
medium 6.5

CVE-2021-3524 json

A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in versions before 14.2.21.

published 2021-05-17 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-26840

cvss
6.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.6%
EPSS 1.6% chance of exploitation in 30 days, percentile 76%
public exploits
0
none known

Summary

A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in versions before 14.2.21. The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made. In addition, the prior bug fix for CVE-2020-10753 did not account for the use of \r as a header separator, thus a new flaw has been created.

Patch / fix

  • redhat ceph 14.2.21
  • ceph Debian 14, Debian 13, Debian 12 14.2.21-1

debian advisories DEBIAN-CVE-2021-3524

  • ceph Ubuntu 18.04 LTS 12.2.13-0ubuntu0.18.04.10
  • ceph Ubuntu 20.04 LTS 15.2.12-0ubuntu0.20.04.1
  • ceph Ubuntu Pro 16.04 LTS 10.2.11-0ubuntu0.16.04.3+esm2

ubuntu advisories UBUNTU-CVE-2021-3524

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • ceph ceph storage 5.1 2:16.2.7-98.el8cp
  • cephadm ceph storage 5.1 2:16.2.7-98.el8cp
  • librbd1 ceph storage 5.1 2:16.2.7-98.el8cp
  • librgw2 ceph storage 5.1 2:16.2.7-98.el8cp
  • rbd-nbd ceph storage 5.1 2:16.2.7-98.el8cp
  • ceph-mds ceph storage 5.1 2:16.2.7-98.el8cp
  • ceph-mgr ceph storage 5.1 2:16.2.7-98.el8cp
  • ceph-mon ceph storage 5.1 2:16.2.7-98.el8cp

red hat advisories RHSA-2022:1174RHSA-2022:1716

  • ceph SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLES 15 SP1-BCL +6 more 14.2.21.403+g69ab6ea274d-3.63.1
  • ceph SLE Module for Basesystem 15 SP3, SLE Module for Basesystem 15 SP2, SLE Micro 5.0 +1 more 15.2.12.83+g528da226523-3.25.1

suse advisories SUSE-SU-2021:1835-1SUSE-SU-2021:1834-1

  • ceph openSUSE Leap 15.3 15.2.12.83+g528da226523-3.25.1
  • ceph-test openSUSE Leap 15.3 15.2.12.83+g528da226523-3.25.1
  • ceph openSUSE Leap 15.2 15.2.12.83+g528da226523-lp152.2.18.1
  • ceph-test openSUSE Leap 15.2 15.2.12.83+g528da226523-lp152.2.18.1

opensuse advisories openSUSE-SU-2021:1834-1openSUSE-SU-2021:0833-1

  • ceph Alpine 3.16, Alpine 3.15, Alpine 3.14 16.2.4-r0
  • ceph16 Alpine 3.18, Alpine 3.17 16.2.4-r0

alpine advisories ALPINE-CVE-2021-3524

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-3524 updated cvss 6.5

gateway: radosgw: CRLF injection

  • Red Hat Ceph Storage 2 ceph, librbd1, librgw2, ceph-mds, ceph-mon, ceph-osd, +12 more Red Hat Ceph Storage 3 ceph, librbd1, librgw2, ceph-mds, ceph-mgr, ceph-mon, +15 more
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Openshift Container Storage 4 ceph Red Hat OpenStack Platform 13 (Queens) librbd1, librgw2, ceph-fuse, librados2, libcephfs2, python-rbd, +6 more
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Ceph Storage 4.3 MON ceph 14.2.22-110.el7cp, ceph 14.2.22-110.el8cp, librbd1 14.2.22-110.el7cp, librbd1 14.2.22-110.el8cp, librgw2 14.2.22-110.el7cp, librgw2 14.2.22-110.el8cp, +38 more Red Hat Ceph Storage 4.3 OSD ceph 14.2.22-110.el7cp, ceph 14.2.22-110.el8cp, librbd1 14.2.22-110.el7cp, librbd1 14.2.22-110.el8cp, librgw2 14.2.22-110.el7cp, librgw2 14.2.22-110.el8cp, +26 more Red Hat Ceph Storage 4.3 Tools ceph 14.2.22-110.el7cp, ceph 14.2.22-110.el8cp, librbd1 14.2.22-110.el7cp, librbd1 14.2.22-110.el8cp, librgw2 14.2.22-110.el7cp, librgw2 14.2.22-110.el8cp, +34 more
    fixed: vendor fix RHSA-2022:1716
  • Red Hat Ceph Storage 5.1 MON ceph 16.2.7-98.el8cp, cephadm 16.2.7-98.el8cp, librbd1 16.2.7-98.el8cp, librgw2 16.2.7-98.el8cp, ceph-mgr 16.2.7-98.el8cp, ceph-mon 16.2.7-98.el8cp, +22 more Red Hat Ceph Storage 5.1 OSD ceph 16.2.7-98.el8cp, librbd1 16.2.7-98.el8cp, librgw2 16.2.7-98.el8cp, ceph-osd 16.2.7-98.el8cp, ceph-base 16.2.7-98.el8cp, ceph-test 16.2.7-98.el8cp, +12 more Red Hat Ceph Storage 5.1 Tools ceph 16.2.7-98.el8cp, cephadm 16.2.7-98.el8cp, librbd1 16.2.7-98.el8cp, librgw2 16.2.7-98.el8cp, rbd-nbd 16.2.7-98.el8cp, ceph-mds 16.2.7-98.el8cp, +20 more
    fixed: vendor fix RHSA-2022:1174
  • Red Hat Ceph Storage 4.3 MON python-rsa 4.8-1.el8cp, python3-rsa 4.8-1.el8cp Red Hat Ceph Storage 4.3 Tools libtcmu 1.5.2-5.el7cp, libtcmu 1.5.2-5.el8cp, ceph-iscsi 3.4-5.el7cp, ceph-iscsi 3.4-5.el8cp, libntirpc 3.4-1.1.el7cp, libntirpc 3.4-1.1.el8cp, +20 more Red Hat Ceph Storage 5.1 MON python-rsa 4.8-1.el8cp, python3-rsa 4.8-1.el8cp Red Hat Ceph Storage 5.1 Tools libtcmu 1.5.4-4.el8cp, ceph-iscsi 3.5-2.el8cp, tcmu-runner 1.5.4-4.el8cp, ceph-ansible 6.0.25.4-1.el8cp, cephadm-ansible 0.1-4.g6754c10.el8cp Red Hat Enterprise Linux 7 librbd1, librados2, python-rbd, ceph-common, python-rados Red Hat Enterprise Linux 8 librbd1, librados2, libcephfs2, libradosstriper1
    +1 more products
    Red Hat Enterprise Linux 9 librbd1, librados2
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.60% chance of exploitation in the next 30 days, higher than 76% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected products

  • n/a ceph

Classification

Weakness
  • CWE-20 Improper Input Validation
  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.