CVE-2020-12059

Published: Apr 22, 2020Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

An issue was discovered in Ceph through 13.2.9. A POST request with an invalid tagging XML can crash the RGW process by triggering a NULL pointer exception.

Affected (3)

Products: Linuxfoundation: Ceph · Canonical: Ubuntu Linux

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Linuxfoundation Ceph	Up to 13.2.9

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 16.04
Canonical Ubuntu Linux	Version 18.04

Related CWEs

CWE-476

NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

References (10)

https://bugzilla.suse.com/show_bug.cgi?id=1170170

Source: cve@mitre.org

Issue TrackingPatchThird Party Advisory

https://docs.ceph.com/docs/master/releases/mimic/

Source: cve@mitre.org

Release NotesVendor Advisory

https://lists.debian.org/debian-lts-announce/2023/10/msg00034.html

Source: cve@mitre.org

https://tracker.ceph.com/issues/44967

Source: cve@mitre.org

Issue TrackingVendor Advisory

https://usn.ubuntu.com/4528-1/

Source: cve@mitre.org

Third Party Advisory

https://bugzilla.suse.com/show_bug.cgi?id=1170170