PT-2020-5625 · Red Hat+3 · Ceph+3

Or Friedman · Published 2020-01-31 · Updated 2023-10-23 · CVE-2020-1700

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Ceph (affected versions not specified)

Description A flaw in the Ceph RGW Beast front-end's handling of unexpected disconnects allows an authenticated attacker to make multiple disconnect attempts, resulting in a permanent leak of a socket connection by radosgw. This can lead to a denial of service condition due to the accumulation of CLOSE WAIT sockets, eventually exhausting available resources and preventing legitimate users from connecting to the system. The vulnerability is related to an error in the resource control mechanism of the rgw::asio::ClientIO method in the rgw/rgw asio frontend.cc component of the Ceph storage system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

ALT-PU-2020-1266

ALT-PU-2020-1349

BDU:2021-01325

CVE-2020-1700

DLA-3629-1

OPENSUSE-SU-2020:0187-1

OPENSUSE-SU-2020_0187-1

SUSE-SU-2020:0296-1

USN-4304-1

Affected Products

Alt Linux

Ceph

Suse

Ubuntu

References · 26

• http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00009.html · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3629-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-1700 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-1700 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-1700 · Security Note
• https://osv.dev/vulnerability/USN-4304-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01325 · Security Note
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20210611SE16 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1700 · Security Note
• https://usn.ubuntu.com/4304-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-1700 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-1700 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-1700 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:0187-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4304-1 · Vendor Advisory