Red Hat Security Advisory: Red Hat Ceph Storage 7.1 security, bug fix, and enhancement updates

Fixed packages 128

Vulnerabilities 9

• Critical 9.8
  CVE-2024-24790

  Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip

  The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.

  Go standard library net/netip golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Jun 5, 2024
• High 8.1
  CVE-2024-48916

  Ceph is vulnerable to authentication bypass through RadosGW

  Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has "none" as JWT alg. And by doing so the JWT signature is not checked. The vulnerability is most likely in the RadosGW OIDC prov…

  ceph ceph ceph ceph Debian Ubuntu Azure Linux
  Jul 30, 2025
• High 7.5
  CVE-2023-25577

  Werkzeug may allow high resource usage when parsing multipart form data with many fields

  Werkzeug is a comprehensive WSGI web application library. Prior to version 2.2.3, Werkzeug's multipart form data parser will parse an unlimited number of parts, including file parts. Parts can be a small amount of bytes, but each requires CPU time to parse an…

  pallets werkzeug kubeflow-pipelines-visualization-server werkzeug Debian Ubuntu Azure Linux Wolfi PyPI
  Feb 14, 2023
• High 7.5
  CVE-2024-34069 Public exploit

  Werkzeug's improper usage of a pathname and improper CSRF protection results in the remote command execution

  Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a…

  pallets werkzeug airflow-3 kubeflow-pipelines-visualization-server Debian Ubuntu Azure Linux Wolfi PyPI
  May 6, 2024
• High 7.1
  CVE-2024-47191

  pam_oath.so in oath-toolkit 2.6.7 through 2.6.11 before 2.6.12 allows root privilege escalation because, in the context…

  oath-toolkit oath-toolkit oath-toolkit Debian Ubuntu Azure Linux
  Oct 9, 2024
• Medium 6.8
  CVE-2023-46446

  AsyncSSH Rogue Session Attack

  An issue in AsyncSSH before 2.14.1 allows attackers to control the remote end of an SSH client session via packet injection/removal and shell emulation, aka a "Rogue Session Attack."

  python-asyncssh python-asyncssh asyncssh Debian Ubuntu PyPI
  Nov 14, 2023
• Medium 6.1
  CVE-2024-42353

  WebOb's location header normalization during redirect leads to open redirect

  WebOb provides objects for HTTP requests and responses. When WebOb normalizes the HTTP Location header to include the request hostname, it does so by parsing the URL that the user is to be redirected to with Python's urlparse, and joining it to the base URL. …

  Pylons webob webob python-webob Debian Ubuntu Azure Linux PyPI
  Aug 14, 2024
• Medium 5.9
  CVE-2023-48795 Public exploit Scanner template EPSS 94%

  Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin

  The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server…

  zot kubescape kots k3d Debian Ubuntu Azure Linux Alpine Wolfi PyPI Go crates.io
  Dec 18, 2023
• Low 2.6
  CVE-2023-23934

  Wrkzeug's incorrect parsing of nameless cookies leads to __Host- cookies bypass

  Werkzeug is a comprehensive WSGI web application library. Browsers may allow "nameless" cookies that look like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie l…

  pallets werkzeug kubeflow-pipelines-visualization-server werkzeug Debian Ubuntu Azure Linux Wolfi PyPI
  Feb 14, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2252788
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2270948
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2284356
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2312113
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2314387
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2315596
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2315885
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2321291
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2348763
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2348935
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2348945
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2348968
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2348970
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2349078
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2349723
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2351271
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2351465
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2352965
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2356050
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2356542
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2357889
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2358123
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2358562
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2360911
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2362258
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_4664.json
• report
  https://access.redhat.com/security/cve/CVE-2023-23934
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2170243
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-23934
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-23934
• article
  https://github.com/pallets/werkzeug/commit/cf275f42acad1b5950c50ffe8ef58fe62cdce028
• article
  https://github.com/pallets/werkzeug/releases/tag/2.2.3
• article
  https://github.com/pallets/werkzeug/security/advisories/GHSA-px8h-6qxv-m22q
• report
  https://access.redhat.com/security/cve/CVE-2023-25577
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2170242
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-25577
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-25577
• article
  https://github.com/pallets/werkzeug/commit/517cac5a804e8c4dc4ed038bb20dacd038e7a9f1