CVE-2020-1700: Medium severity ceph Ceph vulnerability
A flaw was found in the way the Ceph RGW Beast front-end handles unexpected disconnects. An authenticated attacker can abuse this flaw by making multiple disconnect attempts resulting in a permanent leak of a socket connection by radosgw. This flaw could lead to a denial of service condition by pile up of CLOSEWAIT sockets, eventually leading to the exhaustion of available resources, preventing legitimate users from connecting to the system.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/cephto a version that resolves this vulnerability.Fixed in 14.2.21-1Fixed in 14.2.21-1+deb11u3Fixed in 16.2.15+ds-0+deb12u2Fixed in 18.2.7+ds-1+deb13u1Fixed in 20.2.2+ds-12
Event History
Frequently Asked Questions
What is CVE-2020-1700?
CVE-2020-1700 is a vulnerability that allows an authenticated attacker to abuse the way the Ceph RGW Beast front-end handles unexpected disconnects, resulting in a permanent leak of a socket connection and potentially leading to a denial of service.
What is the severity of CVE-2020-1700?
CVE-2020-1700 has a severity rating of 6.5, which is considered medium.
Which software versions are affected by CVE-2020-1700?
The following software versions are affected by CVE-2020-1700: ceph 12.2.12-0ubuntu0.18.04.5, ceph 14.2.4-0ubuntu0.19.10.2, ceph 14.2.7-1, Ceph Ceph, Redhat Openshift Container Storage 4.2, openSUSE Leap 15.1, Canonical Ubuntu Linux 18.04, and Canonical Ubuntu Linux 19.10.
How can an authenticated attacker exploit CVE-2020-1700?
An authenticated attacker can exploit CVE-2020-1700 by making multiple disconnect attempts, causing a permanent leak of a socket connection and potentially leading to a denial of service.
Where can I find more information about CVE-2020-1700?
You can find more information about CVE-2020-1700 at the following references: [Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1700), [OpenSUSE security announcement](http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00009.html), and [Ubuntu security notice](https://usn.ubuntu.com/4304-1/).