From 3cd1818af7c22348a98bfa71441d5a47cbecdcce Mon Sep 17 00:00:00 2001 From: Or Friedmann Date: Wed, 15 Jan 2020 21:15:53 +0200 Subject: [PATCH] rgw: improve beast Avoid leaking connections that had partially-consumed client data on unexpected disconnect. Resolves CVE-2020-1700 (moderate impact flaw). Fixes: https://tracker.ceph.com/issues/42531 Signed-off-by: Or Friedmann Signed-off-by: Matt Benjamin Origin: upstream, https://github.com/ceph/ceph/commit/ff72c50a2c43c57aead933eb4903ad1ca6d1748a Gbp-Pq: Name CVE-2020-1700.patch --- src/rgw/rgw_asio_frontend.cc | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/rgw/rgw_asio_frontend.cc b/src/rgw/rgw_asio_frontend.cc index d2dedd004..0ccc46dd9 100644 --- a/src/rgw/rgw_asio_frontend.cc +++ b/src/rgw/rgw_asio_frontend.cc @@ -104,8 +104,7 @@ class StreamIO : public rgw::asio::ClientIO { while (body_remaining.size && !parser.is_done()) { boost::system::error_code ec; beast::http::read_some(stream, buffer, parser, ec); - if (ec == beast::http::error::partial_message || - ec == beast::http::error::need_buffer) { + if (ec == beast::http::error::need_buffer) { break; } if (ec) { -- 2.30.2