CVE-2019-10222

What it actually does

Unauthenticated remote attacker can crash the RGW server by sending valid HTTP headers and then terminating the connection, resulting in denial of service.

Why it matters to the business

Causes repeated service outages for storage clients until the affected server process is restarted, with long-term exposure risk given the multi-year window since disclosure.

How an attack unfolds

An attacker establishes a connection to the front-end, transmits a sequence of valid HTTP headers, and abruptly closes the socket, triggering a crash in the request-handling logic.

How to fix it

Upgrade notary packages on Ubuntu 16.04 LTS, Debian 11, Debian 12, and Debian 13 to version 0.1~ds1-1 or later.

How to confirm the fix worked

Confirm installed package versions meet or exceed 0.1~ds1-1 and perform connection-termination tests against a lab instance to verify stability.

Typical attack path

1. Establish TCP connection to the exposed RGW endpoint
2. Transmit a minimal but valid set of HTTP headers
3. Immediately terminate the connection without completing the request
4. Repeat to sustain denial of service

How to detect it

Review RGW and system logs for abrupt process terminations or restarts correlated with short-lived HTTP connections from untrusted sources.

What your security team should do

• Apply the listed package updates across all affected distributions
• Restrict direct exposure of RGW endpoints to trusted networks where feasible
• Enable process monitoring and automatic restarts for the RGW service