CVE-2020-12059: Null Pointer Dereference
A flaw was found in the Ceph Object Gateway S3 API, where it did not properly validate the POST requests. This flaw allows an attacker to perform a denial of service attack using a malicious POST request with specially crafted XML payload, leading to a crash of the RGW process.
Other sources
A POST request with an invalid tagging XML can crash the RGW process, this issue affects ceph v13.2.9 as well as previous v13.2.x(Mimic releases) and all v12.2.x(Luminous releases). Originally reported at https://tracker.ceph.com/issues/44967
— Red Hat
An issue was discovered in Ceph through 13.2.9. A POST request with an invalid tagging XML can crash the RGW process by triggering a NULL pointer exception.
Affected Software
Remediation
Information
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-12059?
CVE-2020-12059 is a vulnerability in Ceph Object Gateway S3 API that allows an attacker to perform a denial of service attack using a malicious POST request.
What is the severity of CVE-2020-12059?
CVE-2020-12059 has a severity rating of 7.5 (High).
How does CVE-2020-12059 impact Ceph?
CVE-2020-12059 can crash the RGW process of Ceph through a specially crafted XML payload in a POST request.
How can I fix CVE-2020-12059?
To fix CVE-2020-12059, update Ceph to version 13.2.10 or higher.
Are there any references related to CVE-2020-12059?
Yes, here are some references related to CVE-2020-12059: [Reference 1](https://tracker.ceph.com/issues/44967), [Reference 2](https://ceph.io/releases/v13-2-10-mimic-released/), [Reference 3](https://github.com/ceph/ceph/commit/375d926a4f2720a29b079c216bafb884eef985c3).