6.5
Medium
CVE-2020-1700 A flaw was found in the way the Ceph RGW Beast front-end handles unexpected disconnects
Description
A flaw was found in the way the Ceph RGW Beast front-end handles unexpected disconnects. An authenticated attacker can abuse this flaw by making multiple disconnect attempts resulting in a permanent leak of a socket connection by radosgw. This flaw could lead to a denial of service condition by pile up of CLOSE_WAIT sockets, eventually leading to the exhaustion of available resources, preventing legitimate users from connecting to the system.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| ceph 14.2 | 14.2.4-51.el7cp → 14.2.4-125.el8cp | No fix stated |
Other CVEs of ceph
The 7 CVEs of ceph →
CVE-2020-10736
An authorization bypass vulnerability was found in Ceph versions 15.2.0 before 15.2.2, where the ceph-mon and ceph-mgr…
8.0
High
CVE-2020-1760
A flaw was found in the Ceph Object Gateway, where it supports request sent by an anonymous user in Amazon S3
5.8
Medium
CVE-2019-3821
A flaw was found in the way civetweb frontend was handling requests for ceph RGW server with SSL enabled
7.5
High
CVE-2018-14662
It was found Ceph versions before 13.2.4 that authenticated ceph users with read only permissions could steal dm-crypt…
3.5
Low