Skip to content
OpenAdvisories
High DSA-5825-1 2 CVEs

ceph - security update

Published Dec 6, 2024 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 12 ceph 16.2.15+ds-0+deb12u1

Vulnerabilities 2

  • High 8.1
    CVE-2024-48916

    Ceph is vulnerable to authentication bypass through RadosGW

    Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has "none" as JWT alg. And by doing so the JWT signature is not checked. The vulnerability is most likely in the RadosGW OIDC prov…

    ceph ceph ceph ceph Debian Ubuntu Azure Linux
  • Medium 6.5
    CVE-2023-43040 Public exploit

    IBM Spectrum Fusion HCI improper access control

    IBM Spectrum Fusion HCI 2.5.2 through 2.7.2 could allow an attacker to perform unauthorized actions in RGW for Ceph due to improper bucket access. IBM X-Force ID: 266807.

    IBM Spectrum Fusion HCI ceph ceph Debian Ubuntu Azure Linux