Every CVE Search/ Get API key

CVE-2020-12059

An issue was discovered in Ceph through 13.2.9. A POST request with an invalid tagging XML can...

7.5 HighFix available

An issue was discovered in Ceph through 13.2.9. A POST request with an invalid tagging XML can crash the RGW process by triggering a NULL pointer exception.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

2.44%Up 1.4 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.5

An issue was discovered in Ceph through 13.2.9. A POST request with an invalid tagging XML can crash the RGW process by triggering a NULL pointer exception.

Record
CVE-2020-12059
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-476
Updated
2026-11-02
CVE List No score

An issue was discovered in Ceph through 13.2.9. A POST request with an invalid tagging XML can crash the RGW process by triggering a NULL pointer exception.

Record
CVE-2020-12059
Updated
2026-11-02
EUVDEUVD-2020-4375 No score

An issue was discovered in Ceph through 13.2.9. A POST request with an invalid tagging XML can crash the RGW process by triggering a NULL pointer exception.

Record
EUVD-2020-4375
Updated
2026-11-03
GitHub AdvisoriesGHSA-896g-qc8p-7wrp 7.5

An issue was discovered in Ceph through 13.2.9. A POST request with an invalid tagging XML can...

An issue was discovered in Ceph through 13.2.9. A POST request with an invalid tagging XML can crash the RGW process by triggering a NULL pointer exception.

Record
GHSA-896g-qc8p-7wrp
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
OSV 7.5

An issue was discovered in Ceph through 13.2.9. A POST request with an invalid tagging XML can crash the RGW process by triggering a NULL pointer exception.

Record
CVE-2020-12059
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2020-12059 7.5

An issue was discovered in Ceph through 13.2.9. A POST request with an invalid tagging XML can crash the RGW process by triggering a NULL pointer exception.

Record
DEBIAN-CVE-2020-12059
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 6 moreShow less
OSVOESA-2021-1009 7.5

ceph security update

Ceph is a massively scalable, open-source, distributed storage system that runs on commodity hardware and delivers object, block and file system storage.\r\n\r\n Security Fix(es):\r\n\r\n An issue was discovered in Ceph through 13.2.9. A POST request with an invalid tagging XML can crash the RGW process by triggering a NULL pointer exception.(CVE-2020-12059)\r\n\r\n

Record
OESA-2021-1009
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2021:1518 8.2

Red Hat Security Advisory: Red Hat Ceph Storage 3.3 Security and Bug Fix Update

Record
RHSA-2021:1518
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2020-12059 7.5

An issue was discovered in Ceph through 13.2.9. A POST request with an invalid tagging XML can crash the RGW process by triggering a NULL pointer exception.

Record
UBUNTU-CVE-2020-12059
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVBIT-ceph-2020-12059 No score

An issue was discovered in Ceph through 13.2.9. A POST request with an invalid tagging XML can crash the RGW process by triggering a NULL pointer exception.

Record
BIT-ceph-2020-12059
Updated
2026-11-02
OSVSUSE-SU-2020:1158-1 No score

Security update for ceph

This update for ceph fixes the following issues:

  • CVE-2020-12059: Fixed a denial of service caused by a specially crafted XML payload on POST requests (bsc#1170170).
Record
SUSE-SU-2020:1158-1
Updated
2026-11-02
OSVUSN-4528-1 No score

ceph vulnerabilities

Adam Mohammed discovered that Ceph incorrectly handled certain CORS ExposeHeader tags. A remote attacker could possibly use this issue to preform an HTTP header injection attack. (CVE-2020-10753)

Lei Cao discovered that Ceph incorrectly handled certain POST requests with invalid tagging XML. A remote attacker could possibly use this issue to cause Ceph to crash, leading to a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2020-12059)

Robin H. Johnson discovered that Ceph incorrectly handled certain S3 requests. A remote attacker could possibly use this issue to perform a XSS attack. (CVE-2020-1760)

Record
USN-4528-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ceph
Bitnami
 through 13.2.9 None known
ceph
Debian:12
 before 14.2.4-1
14.2.4-1
ceph
Debian:13
 before 14.2.4-1
14.2.4-1
ceph
Debian:14
 before 14.2.4-1
14.2.4-1
ceph
Debian:10
From an advisory covering 12 CVEs
 before 12.2.11+dfsg1-2.1+deb10u1, plus listed versions
12.2.11+dfsg1-2.1
12.2.11+dfsg1-2.1+deb10u1
ceph
openEuler:20.03-LTS
 before 12.2.8-10.oe1
12.2.8-10.oe1
ceph
openEuler:20.03-LTS-SP1
 before 12.2.8-10.oe1
12.2.8-10.oe1
ceph
Red Hat:ceph_storage:3::el7
From an advisory covering 4 CVEs
 before 2:12.2.12-139.el7cp
2:12.2.12-139.el7cp
ceph-base
Red Hat:ceph_storage:3::el7
From an advisory covering 4 CVEs
 before 2:12.2.12-139.el7cp
2:12.2.12-139.el7cp
ceph-common
Red Hat:ceph_storage:3::el7
From an advisory covering 4 CVEs
 before 2:12.2.12-139.el7cp
2:12.2.12-139.el7cp
Show 45 moreShow less
Affected packages
PackageAffectedFixed
ceph-debuginfo
Red Hat:ceph_storage:3::el7
From an advisory covering 4 CVEs
 before 2:12.2.12-139.el7cp
2:12.2.12-139.el7cp
ceph-mgr
Red Hat:ceph_storage:3::el7
From an advisory covering 4 CVEs
 before 2:12.2.12-139.el7cp
2:12.2.12-139.el7cp
ceph-mon
Red Hat:ceph_storage:3::el7
From an advisory covering 4 CVEs
 before 2:12.2.12-139.el7cp
2:12.2.12-139.el7cp
ceph-selinux
Red Hat:ceph_storage:3::el7
From an advisory covering 4 CVEs
 before 2:12.2.12-139.el7cp
2:12.2.12-139.el7cp
ceph-test
Red Hat:ceph_storage:3::el7
From an advisory covering 4 CVEs
 before 2:12.2.12-139.el7cp
2:12.2.12-139.el7cp
libcephfs-devel
Red Hat:ceph_storage:3::el7
From an advisory covering 4 CVEs
 before 2:12.2.12-139.el7cp
2:12.2.12-139.el7cp
libcephfs2
Red Hat:ceph_storage:3::el7
From an advisory covering 4 CVEs
 before 2:12.2.12-139.el7cp
2:12.2.12-139.el7cp
librados-devel
Red Hat:ceph_storage:3::el7
From an advisory covering 4 CVEs
 before 2:12.2.12-139.el7cp
2:12.2.12-139.el7cp
librados2
Red Hat:ceph_storage:3::el7
From an advisory covering 4 CVEs
 before 2:12.2.12-139.el7cp
2:12.2.12-139.el7cp
libradosstriper1
Red Hat:ceph_storage:3::el7
From an advisory covering 4 CVEs
 before 2:12.2.12-139.el7cp
2:12.2.12-139.el7cp
librbd-devel
Red Hat:ceph_storage:3::el7
From an advisory covering 4 CVEs
 before 2:12.2.12-139.el7cp
2:12.2.12-139.el7cp
librbd1
Red Hat:ceph_storage:3::el7
From an advisory covering 4 CVEs
 before 2:12.2.12-139.el7cp
2:12.2.12-139.el7cp
librgw-devel
Red Hat:ceph_storage:3::el7
From an advisory covering 4 CVEs
 before 2:12.2.12-139.el7cp
2:12.2.12-139.el7cp
librgw2
Red Hat:ceph_storage:3::el7
From an advisory covering 4 CVEs
 before 2:12.2.12-139.el7cp
2:12.2.12-139.el7cp
python-cephfs
Red Hat:ceph_storage:3::el7
From an advisory covering 4 CVEs
 before 2:12.2.12-139.el7cp
2:12.2.12-139.el7cp
python-rados
Red Hat:ceph_storage:3::el7
From an advisory covering 4 CVEs
 before 2:12.2.12-139.el7cp
2:12.2.12-139.el7cp
python-rbd
Red Hat:ceph_storage:3::el7
From an advisory covering 4 CVEs
 before 2:12.2.12-139.el7cp
2:12.2.12-139.el7cp
python-rgw
Red Hat:ceph_storage:3::el7
From an advisory covering 4 CVEs
 before 2:12.2.12-139.el7cp
2:12.2.12-139.el7cp
ceph-osd
Red Hat:ceph_storage:3::el7
From an advisory covering 4 CVEs
 before 2:12.2.12-139.el7cp
2:12.2.12-139.el7cp
ceph-ansible
Red Hat:ceph_storage:3::el7
From an advisory covering 4 CVEs
 before 0:3.2.56-1.el7cp
0:3.2.56-1.el7cp
ceph-fuse
Red Hat:ceph_storage:3::el7
From an advisory covering 4 CVEs
 before 2:12.2.12-139.el7cp
2:12.2.12-139.el7cp
ceph-mds
Red Hat:ceph_storage:3::el7
From an advisory covering 4 CVEs
 before 2:12.2.12-139.el7cp
2:12.2.12-139.el7cp
ceph-radosgw
Red Hat:ceph_storage:3::el7
From an advisory covering 4 CVEs
 before 2:12.2.12-139.el7cp
2:12.2.12-139.el7cp
cephmetrics
Red Hat:ceph_storage:3::el7
From an advisory covering 4 CVEs
 before 0:2.0.10-1.el7cp
0:2.0.10-1.el7cp
cephmetrics-ansible
Red Hat:ceph_storage:3::el7
From an advisory covering 4 CVEs
 before 0:2.0.10-1.el7cp
0:2.0.10-1.el7cp
grafana
Red Hat:ceph_storage:3::el7
From an advisory covering 4 CVEs
 before 0:5.2.4-3.el7cp
0:5.2.4-3.el7cp
rbd-mirror
Red Hat:ceph_storage:3::el7
From an advisory covering 4 CVEs
 before 2:12.2.12-139.el7cp
2:12.2.12-139.el7cp
tcmu-runner
Red Hat:ceph_storage:3::el7
From an advisory covering 4 CVEs
 before 0:1.4.0-3.el7cp
0:1.4.0-3.el7cp
tcmu-runner-debuginfo
Red Hat:ceph_storage:3::el7
From an advisory covering 4 CVEs
 before 0:1.4.0-3.el7cp
0:1.4.0-3.el7cp
ceph
SUSE:HPE Helion OpenStack 8
 before 12.2.12+git.1587570958.35d78d0243-2.45.1
12.2.12+git.1587570958.35d78d0243-2.45.1
ceph
SUSE:OpenStack Cloud 8
 before 12.2.12+git.1587570958.35d78d0243-2.45.1
12.2.12+git.1587570958.35d78d0243-2.45.1
ceph
SUSE:OpenStack Cloud Crowbar 8
 before 12.2.12+git.1587570958.35d78d0243-2.45.1
12.2.12+git.1587570958.35d78d0243-2.45.1
ceph
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 12.2.12+git.1587570958.35d78d0243-2.45.1
12.2.12+git.1587570958.35d78d0243-2.45.1
ceph
SUSE:Linux Enterprise Software Development Kit 12 SP4
 before 12.2.12+git.1587570958.35d78d0243-2.45.1
12.2.12+git.1587570958.35d78d0243-2.45.1
ceph
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 12.2.12+git.1587570958.35d78d0243-2.45.1
12.2.12+git.1587570958.35d78d0243-2.45.1
ceph
SUSE:Linux Enterprise Server 12 SP3-LTSS
 before 12.2.12+git.1587570958.35d78d0243-2.45.1
12.2.12+git.1587570958.35d78d0243-2.45.1
ceph
SUSE:Linux Enterprise Server 12 SP3-BCL
 before 12.2.12+git.1587570958.35d78d0243-2.45.1
12.2.12+git.1587570958.35d78d0243-2.45.1
ceph
SUSE:Linux Enterprise Server 12 SP4
 before 12.2.12+git.1587570958.35d78d0243-2.45.1
12.2.12+git.1587570958.35d78d0243-2.45.1
ceph
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 12.2.12+git.1587570958.35d78d0243-2.45.1
12.2.12+git.1587570958.35d78d0243-2.45.1
ceph
SUSE:Linux Enterprise Server 12 SP5
 before 12.2.12+git.1587570958.35d78d0243-2.45.1
12.2.12+git.1587570958.35d78d0243-2.45.1
ceph
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 12.2.12+git.1587570958.35d78d0243-2.45.1
12.2.12+git.1587570958.35d78d0243-2.45.1
ceph
SUSE:Enterprise Storage 5
 before 12.2.12+git.1587570958.35d78d0243-2.45.1
12.2.12+git.1587570958.35d78d0243-2.45.1
ceph
Ubuntu:18.04:LTS
 before 12.2.13-0ubuntu0.18.04.4, plus listed versions
12.2.0-0ubuntu112.2.1-0ubuntu112.2.2-0ubuntu112.2.2-0ubuntu212.2.4-0ubuntu1
Show 13 moreShow less
12.2.4-0ubuntu1.112.2.7-0ubuntu0.18.04.112.2.8-0ubuntu0.18.04.112.2.8-0ubuntu0.18.04.212.2.11-0ubuntu0.18.04.112.2.11-0ubuntu0.18.04.212.2.12-0ubuntu0.18.04.112.2.12-0ubuntu0.18.04.212.2.12-0ubuntu0.18.04.312.2.12-0ubuntu0.18.04.412.2.12-0ubuntu0.18.04.512.2.13-0ubuntu0.18.04.212.2.13-0ubuntu0.18.04.3
12.2.13-0ubuntu0.18.04.4
ceph
Ubuntu:16.04:LTS
From an advisory covering 3 CVEs
 before 10.2.11-0ubuntu0.16.04.3, plus listed versions
0.94.3-0ubuntu20.94.5-0ubuntu19.2.0-0ubuntu39.2.0-0ubuntu49.2.0-0ubuntu5
Show 18 moreShow less
9.2.0-0ubuntu610.0.2-0ubuntu110.0.3-0ubuntu110.0.5-0ubuntu110.1.0-0ubuntu110.1.1-0ubuntu110.1.2-0ubuntu110.2.0-0ubuntu0.16.04.110.2.0-0ubuntu0.16.04.210.2.2-0ubuntu0.16.04.210.2.3-0ubuntu0.16.04.210.2.5-0ubuntu0.16.04.110.2.6-0ubuntu0.16.04.110.2.7-0ubuntu0.16.04.110.2.9-0ubuntu0.16.04.110.2.10-0ubuntu0.16.04.110.2.11-0ubuntu0.16.04.110.2.11-0ubuntu0.16.04.2
10.2.11-0ubuntu0.16.04.3
ceph
Ubuntu:18.04:LTS
From an advisory covering 3 CVEs
 before 12.2.13-0ubuntu0.18.04.4, plus listed versions
12.2.0-0ubuntu112.2.1-0ubuntu112.2.2-0ubuntu112.2.2-0ubuntu212.2.4-0ubuntu1
Show 13 moreShow less
12.2.4-0ubuntu1.112.2.7-0ubuntu0.18.04.112.2.8-0ubuntu0.18.04.112.2.8-0ubuntu0.18.04.212.2.11-0ubuntu0.18.04.112.2.11-0ubuntu0.18.04.212.2.12-0ubuntu0.18.04.112.2.12-0ubuntu0.18.04.212.2.12-0ubuntu0.18.04.312.2.12-0ubuntu0.18.04.412.2.12-0ubuntu0.18.04.512.2.13-0ubuntu0.18.04.212.2.13-0ubuntu0.18.04.3
12.2.13-0ubuntu0.18.04.4

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-12059 is a high vulnerability (CVSS 7.5) in Linuxfoundation Ceph, published April 22, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.44%, the 84th percentile. Fixed in ceph 14.2.4-1.

References

Show 50 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open