Vulnerability CVE-2020-1700

Vulnerability Name:

CVE-2020-1700 (CCN-175570)

Assigned:

2019-11-27

Published:

2020-02-01

Updated:

2022-01-01

Summary:

A flaw was found in the way the Ceph RGW Beast front-end handles unexpected disconnects. An authenticated attacker can abuse this flaw by making multiple disconnect attempts resulting in a permanent leak of a socket connection by radosgw. This flaw could lead to a denial of service condition by pile up of CLOSE_WAIT sockets, eventually leading to the exhaustion of available resources, preventing legitimate users from connecting to the system.

CVSS v3 Severity:

6.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
5.7 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): High

4.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
3.8 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Low

CVSS v2 Severity:

6.8 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Complete

4.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Partial

Vulnerability Type:

CWE-400

Vulnerability Consequences:

Denial of Service

References:

Source: MITRE
Type: CNA
CVE-2020-1700

Source: SUSE
Type: Mailing List, Third Party Advisory
openSUSE-SU-2020:0187

Source: CONFIRM
Type: Issue Tracking, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1700

Source: XF
Type: UNKNOWN
ceph-cve20201700-dos(175570)

Source: CCN
Type: ceph GIT Repository
rgw: improve beast

Source: CCN
Type: oss-sec Mailing List, Sat, 1 Feb 2020 01:17:26 +0530
CVE-2020-1700 ceph: connection leak in the RGW Beast front-end permits a DoS against the RGW server

Source: UBUNTU
Type: Third Party Advisory
USN-4304-1

Vulnerable Configuration:

Configuration 1:

cpe:/a:ceph:ceph:-:*:*:*:*:*:*:*

Configuration 2:

cpe:/a:redhat:openshift_container_storage:4.2:*:*:*:*:*:*:*

Configuration 3:

cpe:/o:opensuse:leap:15.1:*:*:*:*:*:*:*

Configuration 4:

cpe:/o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

OR cpe:/o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:20201700	V	CVE-2020-1700	2022-09-02
oval:org.opensuse.security:def:3786	P	Security update for drbd (Important)	2022-08-03
oval:org.opensuse.security:def:3108	P	iputils-s20121221-2.17 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:3057	P	dracut-044.2-15.1 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:3132	P	libX11-6-1.6.2-12.5.1 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:3148	P	libXv1-1.0.10-7.1 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:3138	P	libXfont1-1.5.1-11.3.12 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:3798	P	syslog-service-2.0-778.1 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:3061	P	elfutils-0.158-7.7.2 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:3146	P	libXt6-1.1.4-3.57 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:3067	P	file-5.22-10.12.2 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:3079	P	giflib-progs-5.0.5-12.1 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:3093	P	gstreamer-plugins-bad-1.8.3-17.2 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:3099	P	gv-3.7.4-1.36 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:69582	P	Security update for net-snmp (Important)	2021-12-27
oval:org.opensuse.security:def:65608	P	Security update for the Linux Kernel (Important)	2021-11-19
oval:org.opensuse.security:def:68296	P	Security update for the Linux Kernel (Live Patch 8 for SLE 15 SP2) (Important)	2021-11-17
oval:org.opensuse.security:def:64602	P	Security update for pcre (Moderate)	2021-10-27
oval:org.opensuse.security:def:74668	P	Security update for the Linux Kernel (Important)	2021-10-15
oval:org.opensuse.security:def:63213	P	libfpm_pb0-1.1.1-2.29 on GA media (Moderate)	2021-09-21
oval:org.opensuse.security:def:48278	P	python-2.7.13-28.31.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:48279	P	python-PyYAML-3.12-26.6.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:48293	P	res-signingkeys-3.0.42-52.38.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:63415	P	jakarta-taglibs-standard-1.1.1-2.42 on GA media (Moderate)	2021-08-10
oval:org.opensuse.security:def:2399	P	libmpg123-0-32bit-1.26.4-1.15 on GA media (Moderate)	2021-08-10
oval:org.opensuse.security:def:62746	P	gcab-1.1-1.15 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:48607	P	python-libxml2-2.9.4-27.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48739	P	libpcsclite1-32bit-1.8.10-3.7 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48831	P	finch-2.12.0-1.33 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:63553	P	libreoffice-6.0.4.2-1.12 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48414	P	expat-2.1.0-17.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:1761	P	cups-ddk-2.2.7-1.24 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:64490	P	Security update for avahi (Moderate)	2021-05-04
oval:org.opensuse.security:def:99928	P	(Moderate)	2021-04-01
oval:org.opensuse.security:def:69687	P	Security update for go1.14 (Moderate)	2021-01-26
oval:org.opensuse.security:def:69045	P	Security update for postgresql, postgresql13 (Moderate)	2021-01-20
oval:org.opensuse.security:def:64448	P	Security update for gcc7 (Moderate)	2020-12-10
oval:org.opensuse.security:def:62718	P	rtkit-0.11+git.20130926-1.34 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:72398	P	liblouis-data-3.11.0-1.42 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:62924	P	python3-tools-3.6.5-3.11.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:62721	P	texlive-12many-2017.133.0.0.3svn15878-6.18 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:48979	P	cyrus-sasl-digestmd5-32bit-2.1.26-8.7.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:71636	P	libtspi1-0.3.14-6.6.2 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:62714	P	ppp-2.4.7-5.3.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:72282	P	libmicrohttpd-devel-0.9.57-1.33 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:71749	P	xorg-x11-devel-7.6.1-1.16 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:49593	P	ppp on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:50724	P	Security update for mozilla-nspr, mozilla-nss (Moderate)	2020-12-01
oval:org.opensuse.security:def:64240	P	dnsmasq on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:64962	P	Security update for libxslt (Moderate)	2020-12-01
oval:org.opensuse.security:def:74542	P	Security update for storeBackup (Moderate)	2020-12-01
oval:org.opensuse.security:def:49720	P	vorbis-tools on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:64346	P	libltdl7 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:65049	P	Security update for ceph (Moderate)	2020-12-01
oval:org.opensuse.security:def:49925	P	python2-pyOpenSSL on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:50071	P	libicu60_2 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49435	P	libexiv2-26 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:65698	P	Security update for ceph (Moderate)	2020-12-01
oval:org.opensuse.security:def:49193	P	libmicrohttpd12 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:50169	P	pidgin-plugin-otr on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:50782	P	Security update for ldb (Moderate)	2020-12-01
oval:org.opensuse.security:def:49506	P	conky on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49404	P	gd on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49277	P	mozilla-nspr-32bit on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:50836	P	Security update for ceph (Moderate)	2020-12-01
oval:org.opensuse.security:def:50326	P	Security update for wireshark (Important)	2020-12-01
oval:org.opensuse.security:def:50820	P	Security update for openldap2 (Moderate)	2020-12-01
oval:org.opensuse.security:def:49339	P	syslog-service on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:68396	P	Security update for ceph (Moderate)	2020-12-01
oval:org.opensuse.security:def:49574	P	libraptor-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:50564	P	Security update for wget (Important)	2020-12-01
oval:org.opensuse.security:def:63779	P	Security update for curl (Important)	2020-12-01
oval:org.opensuse.security:def:52169	P	Security update for postgresql10 and postgresql12 (Moderate)	2020-12-01
oval:org.opensuse.security:def:50893	P	Security update for salt (Moderate)	2020-12-01
oval:org.opensuse.security:def:50789	P	Security update for java-11-openjdk (Important)	2020-12-01
oval:org.opensuse.security:def:49575	P	librsvg-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:50654	P	Security update for python-SQLAlchemy (Important)	2020-12-01
oval:org.opensuse.security:def:52231	P	Security update for ceph (Moderate)	2020-12-01
oval:org.opensuse.security:def:64106	P	Security update for postgresql10 (Important)	2020-12-01
oval:org.opensuse.security:def:68942	P	Security update for perl (Important)	2020-12-01
oval:org.opensuse.security:def:110292	P	Security update for ceph (Moderate)	2020-02-08
oval:com.ubuntu.bionic:def:202017000000000	V	CVE-2020-1700 on Ubuntu 18.04 LTS (bionic) - medium.	2020-02-07
oval:org.opensuse.security:def:91064	P	Security update for ceph (Moderate)	2020-01-31
oval:org.opensuse.security:def:104719	P	Security update for ceph (Moderate)	2020-01-31
oval:org.opensuse.security:def:98029	P	Security update for ceph (Moderate)	2020-01-31
oval:org.opensuse.security:def:75425	P	Security update for ceph (Moderate)	2020-01-31
oval:org.opensuse.security:def:90374	P	Security update for ceph (Moderate)	2020-01-31
oval:org.opensuse.security:def:104029	P	Security update for ceph (Moderate)	2020-01-31

BACK