Date: Tue, 7 Apr 2020 11:59:24 +0530 From: Hardik Vyas <hvyas@...hat.com> To: oss-security@...ts.openwall.com Subject: CVE-2020-1760 ceph: header-splitting in RGW GetObject has a possible XSS Hello, A flaw was found in the Ceph Object Gateway, where it supports unauthenticated requests sent by an anonymous user in Amazon S3. This flaw could lead to potential XSS attacks due to the lack of proper neutralization of untrusted input. If the attacker knows the path to a publicly readable object on any RGW cluster and the object is at least large enough to cover the attack body then it's possible to run an XSS on any object. This flaw was introduced with commit f4a0b2d9260a4523745875e3977a8a1ef9dc5e2e(Oct 9, 2012) and affects all the way up to master. Red Hat has assigned CVE-2020-1760 for this issue. Upstream Patches: https://github.com/ceph/ceph-ci/commit/8aa1f77363ec32bdc57744a143035033291ab5e1 https://github.com/ceph/ceph-ci/commit/18eb4d918b27d362312c29a3bbd57a421897c0a5 https://github.com/ceph/ceph-ci/commit/1bf14094fec34770d2cc74317f4238ccb2dfef98 Credit: - Initial report to DigitalOcean by William Bowling twitter handle @wcbowling - Further evaluation and extension to Robin H. Johnson @robbat2, rjohnson@...italocean.com PS: The patches are currently available from ceph.git clone(ceph-ci) and will be pushed to active releases soon. Regards, -- Hardik Vyas / Red Hat Product Security BD48 C633 DE34 733A BBC3 3B72 8A14 AEBB D68B 9381
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.