Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 7 Apr 2020 11:59:24 +0530
From: Hardik Vyas <>
Subject: CVE-2020-1760 ceph: header-splitting in RGW GetObject has a possible XSS


A flaw was found in the Ceph Object Gateway, where it supports
unauthenticated requests sent by an anonymous
user in Amazon S3. This flaw could lead to potential XSS attacks due to the
lack of proper neutralization of
untrusted input. If the attacker knows the path to a publicly readable
object on any RGW cluster and the object
is at least large enough to cover the attack body then it's possible to run
an XSS on any object.

This flaw was introduced with commit
f4a0b2d9260a4523745875e3977a8a1ef9dc5e2e(Oct 9, 2012) and affects
all the way up to master. Red Hat has assigned CVE-2020-1760 for this issue.

Upstream Patches:


- Initial report to DigitalOcean by William Bowling twitter handle
- Further evaluation and extension to Robin H. Johnson @robbat2,

PS: The patches are currently available from ceph.git clone(ceph-ci) and
will be pushed to active releases soon.


Hardik Vyas / Red Hat Product Security

BD48 C633 DE34 733A BBC3  3B72 8A14 AEBB D68B 9381

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.