CVE-2020-10753

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2020-10753", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "dateUpdated": "2024-08-04T11:14:15.190Z", "dateReserved": "2020-03-20T00:00:00.000Z", "datePublished": "2020-06-26T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2023-10-23T18:06:17.659Z"}, "descriptions": [{"lang": "en", "value": "A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway). The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made. Ceph versions 3.x and 4.x are vulnerable to this issue."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat Ceph Storage", "versions": [{"version": "versions 3.x and 4.x", "status": "affected"}]}], "references": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10753"}, {"name": "openSUSE-SU-2020:0898", "tags": ["vendor-advisory"], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00062.html"}, {"name": "FEDORA-2020-c9bff9688e", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FFU7LXEL2UZE565FJBTY7UGH2O7ZUBVS/"}, {"name": "USN-4528-1", "tags": ["vendor-advisory"], "url": "https://usn.ubuntu.com/4528-1/"}, {"name": "GLSA-202105-39", "tags": ["vendor-advisory"], "url": "https://security.gentoo.org/glsa/202105-39"}, {"name": "[debian-lts-announce] 20210810 [SECURITY] [DLA 2735-1] ceph security update", "tags": ["mailing-list"], "url": "https://lists.debian.org/debian-lts-announce/2021/08/msg00013.html"}, {"name": "[debian-lts-announce] 20231023 [SECURITY] [DLA 3629-1] ceph security update", "tags": ["mailing-list"], "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00034.html"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-113", "cweId": "CWE-113"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T11:14:15.190Z"}, "title": "CVE Program Container", "references": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10753", "tags": ["x_transferred"]}, {"name": "openSUSE-SU-2020:0898", "tags": ["vendor-advisory", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00062.html"}, {"name": "FEDORA-2020-c9bff9688e", "tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FFU7LXEL2UZE565FJBTY7UGH2O7ZUBVS/"}, {"name": "USN-4528-1", "tags": ["vendor-advisory", "x_transferred"], "url": "https://usn.ubuntu.com/4528-1/"}, {"name": "GLSA-202105-39", "tags": ["vendor-advisory", "x_transferred"], "url": "https://security.gentoo.org/glsa/202105-39"}, {"name": "[debian-lts-announce] 20210810 [SECURITY] [DLA 2735-1] ceph security update", "tags": ["mailing-list", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2021/08/msg00013.html"}, {"name": "[debian-lts-announce] 20231023 [SECURITY] [DLA 3629-1] ceph security update", "tags": ["mailing-list", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00034.html"}]}]}}

{}

{"affected": [{"affectedData": [{"product": "Red Hat Ceph Storage", "vendor": "Red Hat", "versions": [{"status": "affected", "version": "versions 3.x and 4.x"}]}], "source": "secalert@redhat.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:ceph_storage:3.0:*:*:*:*:*:*:*", "matchCriteriaId": "516F4E8E-ED2F-4282-9DAB-D8B378F61258", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:ceph_storage:4.0:*:*:*:*:*:*:*", "matchCriteriaId": "D6E54096-5D45-4CB2-AC9A-DDB55BF2B94C", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:openstack:15:*:*:*:*:*:*:*", "matchCriteriaId": "70108B60-8817-40B4-8412-796A592E4E5E", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*", "matchCriteriaId": "36D96259-24BD-44E2-96D9-78CE1D41F956", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*", "matchCriteriaId": "B620311B-34A3-48A6-82DF-6F078D7A4493", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:ceph:*:*:*:*:*:*:*:*", "matchCriteriaId": "26BB96DD-5842-4227-8B10-984C536A5FFB", "versionEndExcluding": "14.2.21", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*", "matchCriteriaId": "7A5301BF-1402-4BE0-A0F8-69FBE79BC6D6", "vulnerable": true}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*", "matchCriteriaId": "23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway). The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made. Ceph versions 3.x and 4.x are vulnerable to this issue."}, {"lang": "es", "value": "Se encontr\u00f3 un fallo en el Red Hat Ceph Storage RadosGW (Ceph Object Gateway). La vulnerabilidad est\u00e1 relacionada con una inyecci\u00f3n de encabezados HTTP por medio de una etiqueta ExposeHeader de CORS. El car\u00e1cter newline en la etiqueta ExposeHeader en el archivo de configuraci\u00f3n de CORS genera una inyecci\u00f3n de encabezado en la respuesta cuando es realizada una petici\u00f3n CORS. Ceph versiones 3.x y 4.x son vulnerables a este problema"}], "id": "CVE-2020-10753", "lastModified": "2026-06-17T02:48:22.820", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "secalert@redhat.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-06-26T15:15:11.573", "references": [{"source": "secalert@redhat.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00062.html"}, {"source": "secalert@redhat.com", "tags": ["Issue Tracking", "Patch", "Vendor Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10753"}, {"source": "secalert@redhat.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2021/08/msg00013.html"}, {"source": "secalert@redhat.com", "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00034.html"}, {"source": "secalert@redhat.com", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FFU7LXEL2UZE565FJBTY7UGH2O7ZUBVS/"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://security.gentoo.org/glsa/202105-39"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://usn.ubuntu.com/4528-1/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00062.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Patch", "Vendor Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10753"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2021/08/msg00013.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00034.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FFU7LXEL2UZE565FJBTY7UGH2O7ZUBVS/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://security.gentoo.org/glsa/202105-39"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://usn.ubuntu.com/4528-1/"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-113"}], "source": "secalert@redhat.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-74"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"acknowledgement": "Red Hat would like to thank Adam Mohammed (Linode) for reporting this issue. Upstream acknowledges William Bowling as the original reporter.", "affected_release": [{"advisory": "RHSA-2020:3504", "cpe": "cpe:/a:redhat:ceph_storage:3::el7", "package": "ceph-2:12.2.12-124.el7cp", "product_name": "Red Hat Ceph Storage 3.3", "release_date": "2020-08-18T00:00:00Z"}, {"advisory": "RHSA-2020:3504", "cpe": "cpe:/a:redhat:ceph_storage:3::el7", "package": "ceph-ansible-0:3.2.48-1.el7cp", "product_name": "Red Hat Ceph Storage 3.3", "release_date": "2020-08-18T00:00:00Z"}, {"advisory": "RHSA-2020:3504", "cpe": "cpe:/a:redhat:ceph_storage:3::el7", "package": "nfs-ganesha-0:2.7.4-13.el7cp", "product_name": "Red Hat Ceph Storage 3.3", "release_date": "2020-08-18T00:00:00Z"}, {"advisory": "RHSA-2020:3505", "cpe": "cpe:/a:redhat:ceph_storage:3::ubuntu16.04", "product_name": "Red Hat Ceph Storage 3 for Ubuntu", "release_date": "2020-08-18T00:00:00Z"}, {"advisory": "RHSA-2020:3003", "cpe": "cpe:/a:redhat:ceph_storage:4::el7", "package": "ceph-2:14.2.8-81.el8cp", "product_name": "Red Hat Ceph Storage 4.1", "release_date": "2020-07-20T00:00:00Z"}, {"advisory": "RHSA-2020:3003", "cpe": "cpe:/a:redhat:ceph_storage:4::el7", "package": "ceph-ansible-0:4.0.25-1.el8cp", "product_name": "Red Hat Ceph Storage 4.1", "release_date": "2020-07-20T00:00:00Z"}, {"advisory": "RHSA-2020:3003", "cpe": "cpe:/a:redhat:ceph_storage:4::el7", "package": "ceph-medic-0:1.0.8-1.el7cp", "product_name": "Red Hat Ceph Storage 4.1", "release_date": "2020-07-20T00:00:00Z"}, {"advisory": "RHSA-2020:3003", "cpe": "cpe:/a:redhat:ceph_storage:4::el7", "package": "cockpit-ceph-installer-0:1.2-0.el8cp", "product_name": "Red Hat Ceph Storage 4.1", "release_date": "2020-07-20T00:00:00Z"}, {"advisory": "RHSA-2020:3003", "cpe": "cpe:/a:redhat:ceph_storage:4::el7", "package": "nfs-ganesha-0:2.8.3-8.el7cp", "product_name": "Red Hat Ceph Storage 4.1", "release_date": "2020-07-20T00:00:00Z"}], "bugzilla": {"description": "ceph: radosgw: HTTP header injection via CORS ExposeHeader tag", "id": "1840744", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1840744"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "status": "verified"}, "cwe": "CWE-113", "details": ["A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway). The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made. Ceph versions 3.x and 4.x are vulnerable to this issue.", "A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway). The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2020-10753", "package_state": [{"cpe": "cpe:/a:redhat:ceph_storage:2", "fix_state": "Out of support scope", "package_name": "ceph", "product_name": "Red Hat Ceph Storage 2"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "ceph", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:openshift_container_storage:4", "fix_state": "Will not fix", "package_name": "ceph", "product_name": "Red Hat Openshift Container Storage 4"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Not affected", "package_name": "ceph", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:15", "fix_state": "Out of support scope", "package_name": "ceph", "product_name": "Red Hat OpenStack Platform 15 (Stein)"}], "public_date": "2020-06-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2020-10753\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-10753\nhttps://ceph.io/releases/v14-2-10-nautilus-released/"], "statement": "* Red Hat Ceph Storage (RHCS) 3 and 4 are affected by this vulnerability. Note: although this issue affects the RadosGW S3 API, it does not affect the Swift API.\n* Red Hat Openshift Container Storage( RHOCS) 4.2 is affected by this flaw. However, because RHOCS 4.2 is now in the Maintenance Phase of support, this issue is not currently planned to be addressed in future updates.\n* Red Hat OpenStack Platform (RHOSP) 13 is not affected by this flaw because RHOSP 13 only ships the ceph client libraries and does not build server code.", "threat_severity": "Moderate"}

{}