CVE-2019-3821

HIGH

civetweb < 1.11 - Unauthenticated Denial of Service via SSL Connection Exhaustion

Title source: llm
STIX 2.1

Description

A flaw was found in the way civetweb frontend was handling requests for ceph RGW server with SSL enabled. An unauthenticated attacker could create multiple connections to ceph RADOS gateway to exhaust file descriptors for ceph-radosgw service resulting in a remote denial of service.

References (3)

Core 3
Core References
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/4035-1/
Issue Tracking, Third Party Advisory x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3821
Issue Tracking, Third Party Advisory x_refsource_misc
https://github.com/ceph/civetweb/pull/33

Scores

CVSS v3 7.5
EPSS 0.0295
EPSS Percentile 85.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-772
Status published
Products (4)
canonical/ubuntu_linux 16.04
canonical/ubuntu_linux 18.10
canonical/ubuntu_linux 19.04
ceph/civetweb < 1.11
Published Mar 27, 2019
Tracked Since Feb 18, 2026