Improper Neutralization of Special Elements in Output Used by a Downstream Component in ceph (Alpine package)



Published: 2020-11-24
Risk Medium
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2020-10753
CWE-ID CWE-74
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe
ceph (Alpine package)
Operating systems & Components / Operating system package or component

Vendor Alpine Linux Development Team

Security Bulletin

This security bulletin contains one medium risk vulnerability.

1) Improper Neutralization of Special Elements in Output Used by a Downstream Component

EUVDB-ID: #VU48628

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-10753

CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to manipulate data.

A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway). The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made. Ceph versions 3.x and 4.x are vulnerable to this issue.

Mitigation

Install update from vendor's website.

Vulnerable software versions

ceph (Alpine package): 14.2.9-r1

External links

http://git.alpinelinux.org/aports/commit/?id=691f407667196e83023a0382be1a522d27ce0c89


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###