Skip to content
OpenAdvisories
High USN-7182-1 1 CVE

ceph vulnerability

Published Jan 6, 2025 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Ceph incorrectly handled unsupported JWT algorithms
in the RadosGW gateway. An attacker could possibly use this issue to bypass
certain authentication checks and restrictions.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS ceph 17.2.7-0ubuntu0.22.04.2
Ubuntu · 24.04 LTS 24.04:LTS ceph 19.2.0-0ubuntu0.24.04.2

Vulnerabilities 1

  • High 8.1
    CVE-2024-48916

    Ceph is vulnerable to authentication bypass through RadosGW

    Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has "none" as JWT alg. And by doing so the JWT signature is not checked. The vulnerability is most likely in the RadosGW OIDC prov…

    ceph ceph ceph ceph Debian Ubuntu Azure Linux

References

  • report
    https://ubuntu.com/security/CVE-2024-48916