PT-2020-6249 · Red Hat+3 · Ceph+3

Lei Cao · Published 2019-03-24 · Updated 2026-03-20 · CVE-2020-12059

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Ceph versions through 13.2.9

Description The issue is related to errors in POST requests with invalid XML tags, which can cause a NULL pointer exception and crash the RGW process. This can be exploited by a remote attacker to cause a denial of service.

Recommendations For versions through 13.2.9, consider restricting access to the RGW process to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using invalid XML tags in POST requests to prevent crashing the RGW process. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALT-PU-2019-1500

BDU:2021-03718

BIT-CEPH-2020-12059

CVE-2020-12059

DLA-3629-1

OESA-2021-1009

RHSA-2021:1518

SUSE-SU-2020:1158-1

SUSE-SU-2020_1158-1

USN-4528-1

Affected Products

Alt Linux

Ceph

Suse

Ubuntu

References · 28

• https://bdu.fstec.ru/vul/2021-03718 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-12059 · Security Note
• https://usn.ubuntu.com/4528-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-10753 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20210611SE16 · Vendor Advisory
• https://tracker.ceph.com/issues/44967 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2021-1009 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-12059 · Vendor Advisory
• https://docs.ceph.com/docs/master/releases/mimic · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:1158-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3629-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-12059 · Security Note
• https://osv.dev/vulnerability/CVE-2020-12059 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-12059 · Vendor Advisory
• https://bugzilla.suse.com/show_bug.cgi?id=1170170 · Patch