CVE-2020-1760
Fixed in a distro release EPSS 2%CVSS 5.8
A flaw was found in the Ceph Object Gateway, where it supports request sent by an anonymous user in Amazon S3. This flaw could lead to potential XSS attacks due to the lack of proper neutralization of untrusted input.
Products: linuxfoundation ceph, redhat ceph_storage, redhat openshift_container_platform, fedoraproject fedora, canonical ubuntu_linux, debian_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 10 | ceph | 12.2.11+dfsg1-2.1+deb10u1 |
| Debian 12 | ceph | 14.2.9-1 |
| Debian 13 | ceph | 14.2.9-1 |
| Debian 14 | ceph | 14.2.9-1 |
| Debian 8 | ceph | 0.80.7-2+deb8u4 |
| Debian 9 | ceph | 10.2.11-2+deb9u1 |
| Red Hat ceph storage 4 | ceph | 2:14.2.8-81.el7cp |
| Red Hat ceph storage 4 | ceph | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | ceph-ansible | 0:4.0.25-1.el7cp |
| Red Hat ceph storage 4 | ceph-ansible | 0:4.0.25-1.el8cp |
| Red Hat ceph storage 4 | ceph-base | 2:14.2.8-81.el7cp |
| Red Hat ceph storage 4 | ceph-base | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | ceph-base-debuginfo | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | ceph-common | 2:14.2.8-81.el7cp |
| Red Hat ceph storage 4 | ceph-common | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | ceph-common-debuginfo | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | ceph-debuginfo | 2:14.2.8-81.el7cp |
| Red Hat ceph storage 4 | ceph-debugsource | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | ceph-fuse | 2:14.2.8-81.el7cp |
| Red Hat ceph storage 4 | ceph-fuse | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | ceph-fuse-debuginfo | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | ceph-grafana-dashboards | 2:14.2.8-81.el7cp |
| Red Hat ceph storage 4 | ceph-grafana-dashboards | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | ceph-mds | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | ceph-mds | 2:14.2.8-81.el7cp |
| Red Hat ceph storage 4 | ceph-mds-debuginfo | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | ceph-medic | 0:1.0.8-1.el8cp |
| Red Hat ceph storage 4 | ceph-medic | 0:1.0.8-1.el7cp |
| Red Hat ceph storage 4 | ceph-mgr | 2:14.2.8-81.el7cp |
| Red Hat ceph storage 4 | ceph-mgr | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | ceph-mgr-dashboard | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | ceph-mgr-dashboard | 2:14.2.8-81.el7cp |
| Red Hat ceph storage 4 | ceph-mgr-debuginfo | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | ceph-mgr-diskprediction-local | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | ceph-mgr-diskprediction-local | 2:14.2.8-81.el7cp |
| Red Hat ceph storage 4 | ceph-mgr-k8sevents | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | ceph-mgr-k8sevents | 2:14.2.8-81.el7cp |
| Red Hat ceph storage 4 | ceph-mgr-rook | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | ceph-mgr-rook | 2:14.2.8-81.el7cp |
| Red Hat ceph storage 4 | ceph-mon | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | ceph-mon | 2:14.2.8-81.el7cp |
| Red Hat ceph storage 4 | ceph-mon-debuginfo | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | ceph-osd | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | ceph-osd | 2:14.2.8-81.el7cp |
| Red Hat ceph storage 4 | ceph-osd-debuginfo | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | ceph-radosgw | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | ceph-radosgw | 2:14.2.8-81.el7cp |
| Red Hat ceph storage 4 | ceph-radosgw-debuginfo | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | ceph-selinux | 2:14.2.8-81.el7cp |
| Red Hat ceph storage 4 | ceph-selinux | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | ceph-test | 2:14.2.8-81.el7cp |
| Red Hat ceph storage 4 | ceph-test | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | ceph-test-debuginfo | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | cockpit-ceph-installer | 0:1.2-0.el7cp |
| Red Hat ceph storage 4 | cockpit-ceph-installer | 0:1.2-0.el8cp |
| Red Hat ceph storage 4 | libcephfs-devel | 2:14.2.8-81.el7cp |
| Red Hat ceph storage 4 | libcephfs-devel | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | libcephfs2 | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | libcephfs2 | 2:14.2.8-81.el7cp |
| Red Hat ceph storage 4 | libcephfs2-debuginfo | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | librados-devel | 2:14.2.8-81.el7cp |
| Red Hat ceph storage 4 | librados-devel | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | librados-devel-debuginfo | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | librados2 | 2:14.2.8-81.el7cp |
| Red Hat ceph storage 4 | librados2 | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | librados2-debuginfo | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | libradospp-devel | 2:14.2.8-81.el7cp |
| Red Hat ceph storage 4 | libradospp-devel | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | libradosstriper1 | 2:14.2.8-81.el7cp |
| Red Hat ceph storage 4 | libradosstriper1 | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | libradosstriper1-debuginfo | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | librbd-devel | 2:14.2.8-81.el7cp |
| Red Hat ceph storage 4 | librbd-devel | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | librbd1 | 2:14.2.8-81.el7cp |
| Red Hat ceph storage 4 | librbd1 | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | librbd1-debuginfo | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | librgw-devel | 2:14.2.8-81.el7cp |
| Red Hat ceph storage 4 | librgw-devel | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | librgw2 | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | librgw2 | 2:14.2.8-81.el7cp |
| Red Hat ceph storage 4 | librgw2-debuginfo | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | nfs-ganesha | 0:2.8.3-8.el7cp |
| Red Hat ceph storage 4 | nfs-ganesha | 0:2.8.3-8.el8cp |
| Red Hat ceph storage 4 | nfs-ganesha-ceph | 0:2.8.3-8.el7cp |
| Red Hat ceph storage 4 | nfs-ganesha-ceph | 0:2.8.3-8.el8cp |
| Red Hat ceph storage 4 | nfs-ganesha-ceph-debuginfo | 0:2.8.3-8.el8cp |
| Red Hat ceph storage 4 | nfs-ganesha-debuginfo | 0:2.8.3-8.el7cp |
| Red Hat ceph storage 4 | nfs-ganesha-debuginfo | 0:2.8.3-8.el8cp |
| Red Hat ceph storage 4 | nfs-ganesha-debugsource | 0:2.8.3-8.el8cp |
| Red Hat ceph storage 4 | nfs-ganesha-proxy | 0:2.8.3-8.el8cp |
| Red Hat ceph storage 4 | nfs-ganesha-proxy | 0:2.8.3-8.el7cp |
| Red Hat ceph storage 4 | nfs-ganesha-proxy-debuginfo | 0:2.8.3-8.el8cp |
| Red Hat ceph storage 4 | nfs-ganesha-rados-grace | 0:2.8.3-8.el7cp |
| Red Hat ceph storage 4 | nfs-ganesha-rados-grace | 0:2.8.3-8.el8cp |
| Red Hat ceph storage 4 | nfs-ganesha-rados-grace-debuginfo | 0:2.8.3-8.el8cp |
| Red Hat ceph storage 4 | nfs-ganesha-rados-urls | 0:2.8.3-8.el8cp |
| Red Hat ceph storage 4 | nfs-ganesha-rados-urls | 0:2.8.3-8.el7cp |
| Red Hat ceph storage 4 | nfs-ganesha-rados-urls-debuginfo | 0:2.8.3-8.el8cp |
| Red Hat ceph storage 4 | nfs-ganesha-rgw | 0:2.8.3-8.el7cp |
| Red Hat ceph storage 4 | nfs-ganesha-rgw | 0:2.8.3-8.el8cp |
| Red Hat ceph storage 4 | nfs-ganesha-rgw-debuginfo | 0:2.8.3-8.el8cp |
| Red Hat ceph storage 4 | nfs-ganesha-selinux | 0:2.8.3-8.el8cp |
| Red Hat ceph storage 4 | nfs-ganesha-selinux | 0:2.8.3-8.el7cp |
| Red Hat ceph storage 4 | nfs-ganesha-vfs | 0:2.8.3-8.el7cp |
| Red Hat ceph storage 4 | nfs-ganesha-vfs | 0:2.8.3-8.el8cp |
| Red Hat ceph storage 4 | nfs-ganesha-vfs-debuginfo | 0:2.8.3-8.el8cp |
| Red Hat ceph storage 4 | python-ceph-argparse | 2:14.2.8-81.el7cp |
| Red Hat ceph storage 4 | python-cephfs | 2:14.2.8-81.el7cp |
| Red Hat ceph storage 4 | python-rados | 2:14.2.8-81.el7cp |
| Red Hat ceph storage 4 | python-rbd | 2:14.2.8-81.el7cp |
| Red Hat ceph storage 4 | python-rgw | 2:14.2.8-81.el7cp |
| Red Hat ceph storage 4 | python3-ceph-argparse | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | python3-cephfs | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | python3-cephfs-debuginfo | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | python3-rados | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | python3-rados-debuginfo | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | python3-rbd | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | python3-rbd-debuginfo | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | python3-rgw | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | python3-rgw-debuginfo | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | rbd-fuse-debuginfo | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | rbd-mirror | 2:14.2.8-81.el7cp |
| Red Hat ceph storage 4 | rbd-mirror | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | rbd-mirror-debuginfo | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | rbd-nbd | 2:14.2.8-81.el7cp |
| Red Hat ceph storage 4 | rbd-nbd | 2:14.2.8-81.el8cp |
| Red Hat ceph storage 4 | rbd-nbd-debuginfo | 2:14.2.8-81.el8cp |
| SUSE Enterprise Storage 5 | ceph | 12.2.12+git.1585658687.363df3a813-2.42.4 |
| SUSE Enterprise Storage 6 | ceph | 14.2.5.389+gb0f23ac248-3.35.2 |
| SUSE Linux Enterprise Module for Basesystem 15 SP1 | ceph | 14.2.5.389+gb0f23ac248-3.35.2 |
| SUSE Linux Enterprise Server 12 SP4 | ceph | 12.2.12+git.1585658687.363df3a813-2.42.4 |
| SUSE Linux Enterprise Server 12 SP5 | ceph | 12.2.12+git.1585658687.363df3a813-2.42.4 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | ceph | 12.2.12+git.1585658687.363df3a813-2.42.4 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | ceph | 12.2.12+git.1585658687.363df3a813-2.42.4 |
| SUSE Linux Enterprise Software Development Kit 12 SP4 | ceph | 12.2.12+git.1585658687.363df3a813-2.42.4 |
| SUSE Linux Enterprise Software Development Kit 12 SP5 | ceph | 12.2.12+git.1585658687.363df3a813-2.42.4 |
| Ubuntu 16.04 LTS | ceph | 10.2.11-0ubuntu0.16.04.3 |
| Ubuntu 18.04 LTS | ceph | 12.2.13-0ubuntu0.18.04.4 |
| Ubuntu Pro 14.04 LTS | ceph | no fix |
| openSUSE Leap 15.1 | ceph | 14.2.5.389+gb0f23ac248-lp151.2.13.1 |
| openSUSE Leap 15.1 | ceph-test | 14.2.5.389+gb0f23ac248-lp151.2.13.1 |