CVE-2024-48916
Ceph is vulnerable to authentication bypass through RadosGW
概要
Ceph is vulnerable to authentication bypass through RadosGW
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has "none" as JWT alg. And by doing so the JWT signature is not checked. The vulnerability is most likely in the RadosGW OIDC provider. As of time of publication, a known patched version has yet to be published.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2024-48916 ceph 修正版: 16.2.15+ds-0+deb12u1
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov