{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat Ceph Storage 1.3.1 that fixes one security issue, multiple bugs,\nand adds various enhancements is now available for Ubuntu 14.04.\n\nRed Hat Product Security has rated this update as having Moderate security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Ceph Storage is a massively scalable, open, software-defined\nstorage platform that combines the most stable version of the Ceph storage\nsystem with a Ceph management platform, deployment tools, and\nsupport services.\n\nA feature in Ceph Object Gateway (RGW) allows to return a specific HTTP\nheader that contains the name of a bucket that was accessed. It was found\nthat the returned HTTP headers were not sanitized. An unauthenticated\nattacker could use this flaw to craft HTTP headers in responses that would\nconfuse the load balancer residing in front of RGW, potentially resulting\nin a denial of service. (CVE-2015-5245)\n\nThe ceph packages have been upgraded to upstream version 0.94.3 and the\nradosgw-agent packages have been upgraded to upstream version 1.2.3.\nThe new versions provide a number of bug fixes and enhancements over the\nprevious versions. (BZ#1238415)\n\nThis update also fixes the following bugs:\n\n* This update fixes various bugs in the Ceph monitor nodes and the Ceph\nObject Storage Device (OSD) Daemons. (BZ#1219040, BZ#1223941, BZ#1265973)\n\n* With this update, when using the Civetweb server, the Ceph Object Gateway\nno longer reports the full object size downloaded even though the download\nwas aborted in the middle. (BZ#1235845)\n\n* The Civetweb server now correctly displays the HTTP return code in the\nlog files. (BZ#1245663)\n\n* The Ceph Object Gateway now correctly assigns Access Control Lists (ACL)\nto new objects created during the copy operation. (BZ#1253766)\n\n* Under certain circumstances, copying an object onto itself (for example,\nto change its metadata) produced a truncated object. The truncated object\nhad correct metadata, including the original size, but the underlying RADOS\nobject was smaller. Consequently, when a client attempted to fetch the\nobject, it received less data than indicated by the Content-Length header,\nblocked for more, and eventually timed out. This bug has been fixed, and\nthe object can now be read successfully in the aforementioned scenario.\n(BZ#1258618)\n\n* The Ceph Object Gateway no longer requires the \"requiretty\" setting to be\ndisabled in the sudoers configuration for the root user. (BZ#1238521)\n\n* In certain scenarios, when all acting set Ceph Object Storage Device\n(OSD) Daemons for a placement group (PG) were restarted during the backfill\nprocess, the OSDs failed to peer the PG. Now, the OSDs peer the PGs as\nexpected. (BZ#1223532)\n\nIn addition, this update adds the following enhancements:\n\n* Administrators of the Ceph Object Gateway can now configure the maximum\nnumber of buckets for users by using the new \"rgw_user_max_buckets\" option\nin the Ceph configuration file. (BZ#1254343)\n\n* The suicide timeout option is now configurable. The option ensures that\npoorly behaving OSDs self-terminate instead of running in degraded states\nand slowing traffic. (BZ#1210825)\n\n* The rhcs-installer package provides a new Foreman-based installer.\nThis update adds the new rhcs-installer package to Red Hat Ceph Storage as\na Technology Preview. (BZ#1213026, BZ#1213086, BZ#1220961)\n\nMore information about Red Hat Technology Previews is available here:\nhttps://access.redhat.com/support/offerings/techpreview/\n\nAll Red Hat Ceph Storage users are advised to upgrade to this new version,\nwhich corrects these issues and adds these enhancements.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2015:2512",
        "url": "https://access.redhat.com/errata/RHSA-2015:2512"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/support/offerings/techpreview/",
        "url": "https://access.redhat.com/support/offerings/techpreview/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/articles/1554343",
        "url": "https://access.redhat.com/articles/1554343"
      },
      {
        "category": "external",
        "summary": "1210825",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1210825"
      },
      {
        "category": "external",
        "summary": "1219040",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1219040"
      },
      {
        "category": "external",
        "summary": "1220961",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1220961"
      },
      {
        "category": "external",
        "summary": "1223532",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1223532"
      },
      {
        "category": "external",
        "summary": "1223941",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1223941"
      },
      {
        "category": "external",
        "summary": "1224174",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1224174"
      },
      {
        "category": "external",
        "summary": "1224877",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1224877"
      },
      {
        "category": "external",
        "summary": "1228842",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1228842"
      },
      {
        "category": "external",
        "summary": "1235845",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1235845"
      },
      {
        "category": "external",
        "summary": "1238415",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1238415"
      },
      {
        "category": "external",
        "summary": "1253766",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1253766"
      },
      {
        "category": "external",
        "summary": "1254814",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1254814"
      },
      {
        "category": "external",
        "summary": "1255830",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1255830"
      },
      {
        "category": "external",
        "summary": "1258618",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1258618"
      },
      {
        "category": "external",
        "summary": "1258621",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1258621"
      },
      {
        "category": "external",
        "summary": "1261606",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1261606"
      },
      {
        "category": "external",
        "summary": "1265973",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1265973"
      },
      {
        "category": "external",
        "summary": "1277393",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1277393"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_2512.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Ceph Storage 1.3.1 security, bug fix, and enhancement update",
    "tracking": {
      "current_release_date": "2026-06-28T12:26:17+00:00",
      "generator": {
        "date": "2026-06-28T12:26:17+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.2.6"
        }
      },
      "id": "RHSA-2015:2512",
      "initial_release_date": "2015-11-23T20:20:28+00:00",
      "revision_history": [
        {
          "date": "2015-11-23T20:20:28+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2016-02-02T22:15:52+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-06-28T12:26:17+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Ceph Storage 1.3 for Ubuntu",
                "product": {
                  "name": "Red Hat Ceph Storage 1.3 for Ubuntu",
                  "product_id": "Red Hat Ceph Storage 1.3 for Ubuntu",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:ceph_storage:1.3::ubuntu:14.04"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Ceph Storage"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2015-5245",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2015-08-31T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1261606"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A feature in Ceph Object Gateway (RGW) allows to return a specific HTTP header that contains the name of a bucket that was accessed. It was found that the returned HTTP headers were not sanitized. An unauthenticated attacker could use this flaw to craft HTTP headers in responses that would confuse the load balancer residing in front of RGW, potentially resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Ceph: RGW returns requested bucket name raw in Bucket response header",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ceph Storage 1.3 for Ubuntu"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-5245"
        },
        {
          "category": "external",
          "summary": "RHBZ#1261606",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1261606"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-5245",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-5245"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-5245",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5245"
        }
      ],
      "release_date": "2015-08-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-11-23T20:20:28+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nTo obtain this new version of Red Hat Ceph Storage for Ubuntu, download a\nnew ISO image, ceph-1.3-ubuntu-x86_64-dvd.iso, from the Customer Portal.\nFor more information on the installation and updating process, see the\nInstallation Guide for Ubuntu.",
          "product_ids": [
            "Red Hat Ceph Storage 1.3 for Ubuntu"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:2512"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.5,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat Ceph Storage 1.3 for Ubuntu"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Ceph: RGW returns requested bucket name raw in Bucket response header"
    }
  ]
}