Security readout for executives and security teams
Plain-English summary
Ceph RGW servers configured with the Beast HTTP frontend could be remotely crashed by an unauthenticated client. The impact is availability: object storage clients may lose access to the RGW service. The source bundle does not show data theft, data modification, or confirmed active exploitation.
Executive priority
Treat as high priority where Ceph RGW is internet-facing or supports critical workloads. The main business risk is outage of object storage access. Patch planning should focus on production RGW endpoints using Beast, while noting the bundle does not support claims of data exposure or active exploitation.
Technical view
CVE-2019-10222 is a Ceph RGW denial-of-service flaw involving Beast frontend request handling. A remote unauthenticated attacker can send valid HTTP headers and terminate the connection, causing the RGW server to crash. CVSS 3.0 is 7.5: network reachable, low complexity, no privileges, no user interaction, high availability impact.
Likely exposure
Exposure is likely limited to Ceph RGW deployments using Beast as the frontend for client HTTP requests. The bundle lists affected versions as n/a, so teams must verify product version and packaging status against Ceph, Red Hat, or Debian guidance.
Exploitation context
The provided sources do not show CISA KEV listing or confirmed active exploitation. The described issue is remotely reachable and unauthenticated, but the documented impact is service crash and denial of service, not code execution or data compromise.
Researcher notes
The key unresolved detail is exact affected and fixed version mapping. The source bundle identifies Ceph RGW with Beast and CWE-755, but lists affected versions as n/a. Use vendor issue trackers and distro advisories to complete version scoping before closure.
Mitigation direction
- Inventory Ceph RGW services and confirm whether Beast is the active frontend.
- Check Ceph, Red Hat, and Debian advisories for fixed supported packages.
- Upgrade affected Ceph RGW packages through supported vendor or distribution channels.
- Prioritize exposed RGW endpoints that serve production object storage clients.
- Monitor vendor guidance for any version-specific mitigation not included in this bundle.
Validation and detection
- Confirm RGW frontend configuration and record affected service owners.
- Verify installed Ceph package versions against vendor advisory fixed versions.
- Review RGW crash logs for repeated client-connection-related failures.
- Confirm object storage client availability after patching or configuration changes.
- Track this CVE in vulnerability management until all Beast RGW exposure is resolved.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-755: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2019-10222 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
7.5HighVector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://tracker.ceph.com/issues/40018CVE reference · x_refsource_MISC
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10222CVE reference · x_refsource_CONFIRM
- https://lists.debian.org/debian-lts-announce/2023/10/msg00034.htmlCVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Handling of Exceptional Conditions
Improper Handling of Exceptional Conditions represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.