CVE-2016-5009

The handle_command function in mon/Monitor.cc in Ceph allows remote authenticated users to cause a denial of service (segmentation fault and ceph monitor crash) via an (1) empty or (2) crafted prefix.

Score

CVSS 3.0 6.5 Medium

Status

Modified - secalert@redhat.com

Published

2016-07-12

Last modified

2024-08-06

Weaknesses

CWE-20

Affected products

• Ceph (Redhat)
• Ceph Storage Mon (Redhat)
• Ceph Storage Osd (Redhat)
• Enterprise Linux Desktop (Redhat)
• Enterprise Linux For Scientific Computing (Redhat)
• Enterprise Linux Server (Redhat)
• Enterprise Linux Workstation (Redhat)

References

• http://lists.opensuse.org/opensuse-updates/2016-12/msg00126.html
• http://tracker.ceph.com/issues/16297
• https://access.redhat.com/errata/RHSA-2016:1384
• https://access.redhat.com/errata/RHSA-2016:1385
• https://github.com/ceph/ceph/commit/957ece7e95d8f8746191fd9629622d4457d690d6
• https://github.com/ceph/ceph/pull/9700