Red Hat Security Advisory: Red Hat Ceph Storage 8.0 security update

Fixed packages 59

Vulnerabilities 1

• High 8.1
  CVE-2024-48916

  Ceph is vulnerable to authentication bypass through RadosGW

  Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has "none" as JWT alg. And by doing so the JWT signature is not checked. The vulnerability is most likely in the RadosGW OIDC prov…

  ceph ceph ceph ceph Debian Ubuntu Azure Linux
  Jul 30, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2323274
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2323279
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2327848
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2329846
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10956.json
• report
  https://access.redhat.com/security/cve/CVE-2024-48916
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-48916
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-48916
• article
  https://github.com/ceph/ceph/pull/60624/commits/919da3696668a07c6810dfa39301950c81c2eba4
• article
  https://github.com/ceph/ceph/security/advisories/GHSA-5g9m-mmp6-93mq
• article
  https://tracker.ceph.com/issues/68836