| Name | CVE-2020-1760 |
| Description | A flaw was found in the Ceph Object Gateway, where it supports request sent by an anonymous user in Amazon S3. This flaw could lead to potential XSS attacks due to the lack of proper neutralization of untrusted input. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DLA-2171-1, DLA-2735-1, DLA-3629-1 |
| Debian Bugs | 956142 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| ceph (PTS) | jessie, jessie (lts) | 0.80.7-2+deb8u6 | fixed |
| stretch (security) | 10.2.11-2+deb9u1 | fixed | |
| stretch (lts), stretch | 10.2.11-2+deb9u2 | fixed | |
| buster (security), buster, buster (lts) | 12.2.11+dfsg1-2.1+deb10u1 | fixed | |
| bullseye | 14.2.21-1 | fixed | |
| bookworm | 16.2.11+ds-2 | fixed | |
| trixie | 18.2.4+ds-9 | fixed | |
| sid | 18.2.4+ds-10 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| ceph | source | jessie | 0.80.7-2+deb8u4 | DLA-2171-1 | ||
| ceph | source | stretch | 10.2.11-2+deb9u1 | DLA-2735-1 | ||
| ceph | source | buster | 12.2.11+dfsg1-2.1+deb10u1 | DLA-3629-1 | ||
| ceph | source | (unstable) | 14.2.9-1 | 956142 |
Introduced with: https://github.com/ceph/ceph-ci/commit/f4a0b2d9260a4523745875e3977a8a1ef9dc5e2e
Fixed by: https://github.com/ceph/ceph-ci/commit/8aa1f77363ec32bdc57744a143035033291ab5e1
Fixed by: https://github.com/ceph/ceph-ci/commit/18eb4d918b27d362312c29a3bbd57a421897c0a5
Fixed by: https://github.com/ceph/ceph-ci/commit/1bf14094fec34770d2cc74317f4238ccb2dfef98
https://www.openwall.com/lists/oss-security/2020/04/07/1