|
Bugzilla – Full Text Bug Listing |
| Summary: | VUL-0: CVE-2020-1760: ceph: RGW GetObject has a XSS via header-splitting | ||
|---|---|---|---|
| Product: | [Novell Products] SUSE Security Incidents | Reporter: | Wolfgang Frisch <wolfgang.frisch> |
| Component: | Incidents | Assignee: | Security Team bot <security-team> |
| Status: | RESOLVED FIXED | QA Contact: | Security Team bot <security-team> |
| Severity: | Normal | ||
| Priority: | P3 - Medium | CC: | cathy.hu, ceph-bugs, holgi, lmb, ncutler, rfrohl, tserong |
| Version: | unspecified | ||
| Target Milestone: | --- | ||
| Hardware: | Other | ||
| OS: | Other | ||
| URL: | https://smash.suse.de/issue/254710/ | ||
| Whiteboard: | CVSSv3.1:SUSE:CVE-2020-1760:6.1:(AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) | ||
| Found By: | --- | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
|
Description
Wolfgang Frisch
2020-03-12 11:09:12 UTC
Here's what I can share of the HAProxy mitigation: === acl req_s3_GetObject REDACTED ## redacted uses internal Lua to detect GetObject acl has_accesskey REDACTED ## redacted uses internal Lua to detect & validate signature # detection 1, QPs present acl req_s3_GetObject_urlp_response url_param(response-cache-control) -m found acl req_s3_GetObject_urlp_response url_param(response-expires) -m found acl req_s3_GetObject_urlp_response url_param(response-content-disposition) -m found acl req_s3_GetObject_urlp_response url_param(response-content-encoding) -m found acl req_s3_GetObject_urlp_response url_param(response-content-language) -m found acl req_s3_GetObject_urlp_response url_param(response-content-type) -m found # detection 2, QPs containing unprintable ascii incl CRLR acl req_s3_GetObject_urlp_response_crlf url_param(response-cache-control) -m sub -i %00 %01 %02 %03 %04 %05 %06 %07 %08 %09 %0a %0b %0c %0d %0e %0f %10 %11 %12 %13 %14 %15 %16 %17 %18 %19 %1a %1b %1c %1d %1e %1f acl req_s3_GetObject_urlp_response_crlf url_param(response-expires) -m sub -i %00 %01 %02 %03 %04 %05 %06 %07 %08 %09 %0a %0b %0c %0d %0e %0f %10 %11 %12 %13 %14 %15 %16 %17 %18 %19 %1a %1b %1c %1d %1e %1f acl req_s3_GetObject_urlp_response_crlf url_param(response-content-disposition) -m sub -i %00 %01 %02 %03 %04 %05 %06 %07 %08 %09 %0a %0b %0c %0d %0e %0f %10 %11 %12 %13 %14 %15 %16 %17 %18 %19 %1a %1b %1c %1d %1e %1f acl req_s3_GetObject_urlp_response_crlf url_param(response-content-encoding) -m sub -i %00 %01 %02 %03 %04 %05 %06 %07 %08 %09 %0a %0b %0c %0d %0e %0f %10 %11 %12 %13 %14 %15 %16 %17 %18 %19 %1a %1b %1c %1d %1e %1f acl req_s3_GetObject_urlp_response_crlf url_param(response-content-language) -m sub -i %00 %01 %02 %03 %04 %05 %06 %07 %08 %09 %0a %0b %0c %0d %0e %0f %10 %11 %12 %13 %14 %15 %16 %17 %18 %19 %1a %1b %1c %1d %1e %1f acl req_s3_GetObject_urlp_response_crlf url_param(response-content-type) -m sub -i %00 %01 %02 %03 %04 %05 %06 %07 %08 %09 %0a %0b %0c %0d %0e %0f %10 %11 %12 %13 %14 %15 %16 %17 %18 %19 %1a %1b %1c %1d %1e %1f # block for detection 1 http-request use-service lua.REDACTED if req_s3_GetObject req_s3_GetObject_urlp_response !has_accesskey # block for detection 2 http-request use-service lua.REDACTED if req_s3_GetObject req_s3_GetObject_urlp_response_crlf === SUSE-SU-2020:0930-1: An update that fixes two vulnerabilities is now available. Category: security (important) Bug References: 1166403,1166484 CVE References: CVE-2020-1759,CVE-2020-1760 Sources used: SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1 (src): ceph-14.2.5.389+gb0f23ac248-3.35.2, ceph-test-14.2.5.389+gb0f23ac248-3.35.2 SUSE Linux Enterprise Module for Basesystem 15-SP1 (src): ceph-14.2.5.389+gb0f23ac248-3.35.2 SUSE Enterprise Storage 6 (src): ceph-14.2.5.389+gb0f23ac248-3.35.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. SUSE-SU-2020:0962-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 1166484 CVE References: CVE-2020-1760 Sources used: SUSE Linux Enterprise Software Development Kit 12-SP5 (src): ceph-12.2.12+git.1585658687.363df3a813-2.42.4 SUSE Linux Enterprise Software Development Kit 12-SP4 (src): ceph-12.2.12+git.1585658687.363df3a813-2.42.4 SUSE Linux Enterprise Server 12-SP5 (src): ceph-12.2.12+git.1585658687.363df3a813-2.42.4 SUSE Linux Enterprise Server 12-SP4 (src): ceph-12.2.12+git.1585658687.363df3a813-2.42.4 SUSE Enterprise Storage 5 (src): ceph-12.2.12+git.1585658687.363df3a813-2.42.4 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. openSUSE-SU-2020:0494-1: An update that fixes two vulnerabilities is now available. Category: security (important) Bug References: 1166403,1166484 CVE References: CVE-2020-1759,CVE-2020-1760 Sources used: openSUSE Leap 15.1 (src): ceph-14.2.5.389+gb0f23ac248-lp151.2.13.1, ceph-test-14.2.5.389+gb0f23ac248-lp151.2.13.1 Thanks a lot for clarifying. Closing. |