Bug 1827262 (CVE-2020-12059) - CVE-2020-12059 ceph: specially crafted XML payload on POST requests leads to DoS by crashing RGW
Summary: CVE-2020-12059 ceph: specially crafted XML payload on POST requests leads to ...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-12059
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1827318
Blocks: 1827270
TreeView+ depends on / blocked
 
Reported: 2020-04-23 13:52 UTC by Hardik Vyas
Modified: 2021-05-06 20:33 UTC (History)
28 users (show)

Fixed In Version: ceph 13.2.10
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the Ceph Object Gateway S3 API, where it did not properly validate the POST requests. This flaw allows an attacker to perform a denial of service attack using a malicious POST request with specially crafted XML payload, leading to a crash of the RGW process.
Clone Of:
Environment:
Last Closed: 2021-05-06 20:33:54 UTC
Embargoed:

Attachments (Terms of Use)

Description Hardik Vyas 2020-04-23 13:52:58 UTC 
A POST request with an invalid tagging XML can crash the RGW process, this issue affects ceph v13.2.9 as well as previous v13.2.x(Mimic releases) and all v12.2.x(Luminous releases).
Originally reported at https://tracker.ceph.com/issues/44967
Comment 4 Hardik Vyas 2020-04-23 16:06:07 UTC 
Mitigation:

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Comment 6 Hardik Vyas 2020-04-24 05:32:58 UTC 
External References:

https://ceph.io/releases/v13-2-10-mimic-released/
Comment 7 Hardik Vyas 2020-04-24 05:37:39 UTC 
Upstream patch : https://github.com/ceph/ceph/commit/375d926a4f2720a29b079c216bafb884eef985c3 [v13.2.10]
Comment 8 Nick Tait 2020-04-24 17:38:06 UTC 
Statement:

This issue affects the versions of ceph as shipped with Red Hat Ceph Storage 3, as it does not validate the parameter when reading the tagging field from POST obj XML.

Red Hat OpenStack Platform 13 provides only the ceph client library and is not affected by this vulnerability.
Comment 12 errata-xmlrpc 2021-05-06 18:31:57 UTC 
This issue has been addressed in the following products:

  Red Hat Ceph Storage 3 - ELS

Via RHSA-2021:1518 https://access.redhat.com/errata/RHSA-2021:1518
Comment 13 Product Security DevOps Team 2021-05-06 20:33:54 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-12059
Note You need to log in before you can comment on or make changes to this bug.