CANONICALVERIFIED
USN-8867-1: Ceph vulnerability
Checked 6 Oct 2026. BlackTree preserves the last verified facts if a later source check is temporarily unavailable.
Open the official publisher source
← Lifecycle catalogue
UBUNTU SECURITY NOTICECANONICALVERIFIED
PUBLISHER UPDATE · USN-8867-1
USN-8867-1 release notes and known issues
USN-8867-1: Ceph vulnerability
Scope: Ubuntu. This update record adds version, fix and known-issue context. Its publication date is not a lifecycle boundary.
Summary
It was discovered that the Ceph Object Gateway (RGW) SigV4 handler did not reject requests carrying x-amz-* headers that were absent from the signed header set. An attacker holding a presigned URL could possibly use this issue to attach arbitrary unsigned x-amz-* headers that RGW would honor, allowing them to escalate their privileges beyond what the URL's signer intended.
Improvements and security content
- It was discovered that the Ceph Object Gateway (RGW) SigV4 handler did not reject requests carrying x-amz-* headers that were absent from the signed header set. An attacker holding a presigned URL could possibly use this issue to attach arbitrary unsigned x-amz-* headers that RGW would honor, allowing them to escalate their privileges beyond what the URL's signer intended.
Known issues
Publisher statementNot stated. The verified publisher record does not contain a known-issues statement.
Affected products and versions
Products
- Ubuntu
Affected versions
- See the official publisher source for applicability.
Fixed versions or updates
- No fixed version is stated in this record.
Recommended action
Review the official publisher document before deployment.
Lifecycle connections
These links connect the publisher update to related Lifecycle records without treating the update publication date as an end-of-support date.