CVE-2020-1700
Fixed in a distro release EPSS 2%CVSS 6.5
A flaw was found in the way the Ceph RGW Beast front-end handles unexpected disconnects. An authenticated attacker can abuse this flaw by making multiple disconnect attempts resulting in a permanent leak of a socket connection by radosgw. This flaw could lead to a denial of service condition by pile up of CLOSE_WAIT sockets, eventually leading to the exhaustion of available resources, preventing legitimate users from connecting to the system.
Products: ceph, redhat openshift_container_storage, opensuse leap, canonical ubuntu_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | ceph-18 | 0 |
| Chainguard | ceph-19 | 0 |
| Chainguard | ceph-20 | 0 |
| Chainguard | ceph-20-dev | 0 |
| Chainguard | ceph-20-doc | 0 |
| Chainguard | ceph-20-libs | 0 |
| Debian 10 | ceph | 12.2.11+dfsg1-2.1+deb10u1 |
| Debian 12 | ceph | 14.2.7-1 |
| Debian 13 | ceph | 14.2.7-1 |
| Debian 14 | ceph | 14.2.7-1 |
| SUSE Enterprise Storage 6 | ceph | 14.2.5.382+g8881d33957-3.30.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP1 | ceph | 14.2.5.382+g8881d33957-3.30.1 |
| Ubuntu 18.04 LTS | ceph | 12.2.12-0ubuntu0.18.04.5 |
| Wolfi | ceph-20 | 0 |
| Wolfi | ceph-20-dev | 0 |
| Wolfi | ceph-20-doc | 0 |
| Wolfi | ceph-20-libs | 0 |
| openSUSE Leap 15.1 | ceph | 14.2.5.382+g8881d33957-lp151.2.10.1 |
| openSUSE Leap 15.1 | ceph-test | 14.2.5.382+g8881d33957-lp151.2.10.1 |