CVE-2020-10753: Canonical Ubuntu Linux

Medium severity, CVSS 6.5. EPSS: 1.6% chance of exploitation in the next 30 days.

A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway). The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made. Ceph versions 3.x and 4.x are vulnerable to this issue.

Affected products

• Canonical Ubuntu Linux: version 16.04 only; version 18.04 only
• Fedoraproject Fedora: version 32 only
• Linuxfoundation Ceph: before 14.2.21 (fixed in 14.2.21)
• Opensuse Leap: version 15.1 only
• Red Hat Ceph Storage: version 3.0 only; version 4.0 only
• Red Hat Openstack: version 15 only

Published 2020-06-26. Last modified 2026-06-17.