LiveActive security incident?Get immediate response
CVE Record

CVE-2019-19337: A flaw was found in Red Hat Ceph Storage version 3 in the way the Ceph RADOS Gateway daemon handles S3 requ...

A flaw was found in Red Hat Ceph Storage version 3 in the way the Ceph RADOS Gateway daemon handles S3 requests. An authenticated attacker can abuse this flaw by causing a remote denial of service by sending a specially crafted HTTP Content-Length header to the Ceph RADOS Gateway server.

MediumCVSS 6.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2019-19337 is a denial-of-service flaw in Red Hat Ceph Storage 3’s S3 gateway. An authenticated user could make the RADOS Gateway unavailable by sending a malformed Content-Length header. The issue affects availability, not data confidentiality or integrity, based on the supplied sources.

Executive priority

Treat this as a moderate availability risk. It does not indicate data theft or privilege escalation, but it can disrupt S3-compatible storage service for affected Red Hat Ceph Storage 3 environments. Prioritize based on business dependence and exposure to untrusted authenticated users.

Technical view

The flaw is improper input validation in the Ceph RADOS Gateway daemon’s S3 request handling. CVSS 3.0 is 6.5: network reachable, low complexity, low privileges required, no user interaction, unchanged scope, and high availability impact. The source bundle states upstream Ceph versions are not affected.

Likely exposure

Exposure is most likely where Red Hat Ceph Storage version 3 runs RADOS Gateway for S3-compatible access and authenticated users can reach it. Environments using upstream Ceph are stated as not affected in the supplied source bundle.

Exploitation context

The sources describe authenticated remote denial of service, but do not cite active exploitation. The CVE is not marked in KEV. Practical risk depends on who can authenticate to the S3 gateway and whether service downtime would disrupt critical workloads.

Researcher notes

Evidence is limited to the CVE metadata and Red Hat Bugzilla reference in the bundle. The affected statement is specific: Red Hat Ceph Storage version 3, with upstream Ceph not affected. No patch version, workaround detail, or exploitation-in-the-wild evidence is provided.

Mitigation direction

  • Check Red Hat guidance for the supported fix or workaround.
  • Prioritize remediation for internet-facing or multi-tenant RADOS Gateway deployments.
  • Restrict RADOS Gateway access to trusted authenticated users and networks where feasible.
  • Monitor gateway availability for unexplained crashes, restarts, or request failures.

Validation and detection

  • Inventory Ceph deployments and identify Red Hat Ceph Storage version 3.
  • Confirm whether the Ceph RADOS Gateway daemon handles S3 requests.
  • Review who can authenticate to the affected gateway.
  • Check logs and monitoring for unexplained RADOS Gateway availability events.
  • Record upstream Ceph deployments separately; sources say upstream versions are not affected.
Prepared
Confidence
high
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-20: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2019-19337 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
6.5 (3.0)
Known Exploited
No
Published

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
6.5CVSS 3.0MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H2.83.6Primary CVE score

Vulnerability scoring details

Base CVSS 3.0 score

6.5Medium
CVSS 3.0 vector shape for CVE-2019-19337Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Red HatCeph Storageversion 3 (upstream versions of Ceph are not affected)Listed
Weakness

CWE details

CWE-20

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.