Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Fri, 14 May 2021 14:55:13 -0400
From: Ana McTaggart <>
Subject: CVE-2021-3509: Ceph: Cross Site Scripting via token Cookie


A flaw was found in the Red Hat Ceph Storage Dashboard. In response to
CVE-2020-27839, the JWT token was moved  from localStorage to an httpOnly
cookie. However, token cookies are used in the body  of the HTTP response
for the documentation, ensuring that the vulnerability remains.

We have assigned it a CVE of CVE-2021-3509, and released patches for it.


Ana McTaggart

Red Hat Product Security

Red Hat Remote <> for urgent response

M: +1 (774)279-0791 <7742790791>     IM: amctagga


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.