{}

{}

{}

{"affected_release": [{"advisory": "RHSA-2024:10956", "cpe": "cpe:/a:redhat:ceph_storage:8.0::el9", "package": "ceph-2:19.2.0-55.el9cp", "product_name": "Red Hat Ceph Storage 8.0", "release_date": "2024-12-11T00:00:00Z"}, {"advisory": "RHSA-2024:10957", "cpe": "cpe:/a:redhat:ceph_storage:8.0::el9", "package": "rhceph/grafana-rhel9:10.4.8-6", "product_name": "Red Hat Ceph Storage 8.0", "release_date": "2024-12-11T00:00:00Z"}, {"advisory": "RHSA-2024:10957", "cpe": "cpe:/a:redhat:ceph_storage:8.0::el9", "package": "rhceph/keepalived-rhel9:2.2.8-36", "product_name": "Red Hat Ceph Storage 8.0", "release_date": "2024-12-11T00:00:00Z"}, {"advisory": "RHSA-2024:10957", "cpe": "cpe:/a:redhat:ceph_storage:8.0::el9", "package": "rhceph/oauth2-proxy-rhel9:v7.6.0-6", "product_name": "Red Hat Ceph Storage 8.0", "release_date": "2024-12-11T00:00:00Z"}, {"advisory": "RHSA-2024:10957", "cpe": "cpe:/a:redhat:ceph_storage:8.0::el9", "package": "rhceph/rhceph-8-rhel9:8-212", "product_name": "Red Hat Ceph Storage 8.0", "release_date": "2024-12-11T00:00:00Z"}, {"advisory": "RHSA-2024:10957", "cpe": "cpe:/a:redhat:ceph_storage:8.0::el9", "package": "rhceph/rhceph-haproxy-rhel9:2.4.22-38", "product_name": "Red Hat Ceph Storage 8.0", "release_date": "2024-12-11T00:00:00Z"}, {"advisory": "RHSA-2024:10957", "cpe": "cpe:/a:redhat:ceph_storage:8.0::el9", "package": "rhceph/rhceph-promtail-rhel9:v3.0.0-9", "product_name": "Red Hat Ceph Storage 8.0", "release_date": "2024-12-11T00:00:00Z"}, {"advisory": "RHSA-2024:10957", "cpe": "cpe:/a:redhat:ceph_storage:8.0::el9", "package": "rhceph/snmp-notifier-rhel9:1.2.1-86", "product_name": "Red Hat Ceph Storage 8.0", "release_date": "2024-12-11T00:00:00Z"}], "bugzilla": {"description": "ceph: rhceph-container: Authentication bypass in CEPH RadosGW", "id": "2329846", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2329846"}, "csaw": false, "cwe": "CWE-345", "details": ["A vulnerability in the Ceph Rados Gateway (RadosGW) OIDC provider allows attackers to bypass JWT signature verification by supplying a token with \"none\" as the algorithm (alg). This occurs because the implementation fails to enforce strict signature validation, enabling attackers to forge valid tokens without a signature."], "name": "CVE-2024-48916", "package_state": [{"cpe": "cpe:/a:redhat:ceph_storage:4", "fix_state": "Affected", "package_name": "ceph", "product_name": "Red Hat Ceph Storage 4"}, {"cpe": "cpe:/a:redhat:ceph_storage:4", "fix_state": "Affected", "package_name": "rhceph/rhceph-4-rhel8", "product_name": "Red Hat Ceph Storage 4"}, {"cpe": "cpe:/a:redhat:ceph_storage:5", "fix_state": "Affected", "package_name": "ceph", "product_name": "Red Hat Ceph Storage 5"}, {"cpe": "cpe:/a:redhat:ceph_storage:5", "fix_state": "Affected", "package_name": "rhceph/rhceph-5-rhel8", "product_name": "Red Hat Ceph Storage 5"}, {"cpe": "cpe:/a:redhat:ceph_storage:6", "fix_state": "Affected", "package_name": "ceph", "product_name": "Red Hat Ceph Storage 6"}, {"cpe": "cpe:/a:redhat:ceph_storage:6", "fix_state": "Affected", "package_name": "rhceph/rhceph-6-rhel9", "product_name": "Red Hat Ceph Storage 6"}, {"cpe": "cpe:/a:redhat:ceph_storage:7", "fix_state": "Affected", "package_name": "ceph", "product_name": "Red Hat Ceph Storage 7"}, {"cpe": "cpe:/a:redhat:ceph_storage:7", "fix_state": "Affected", "package_name": "rhceph/rhceph-7-rhel9", "product_name": "Red Hat Ceph Storage 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "ceph", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "ceph", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-12-02T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-48916\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-48916\nhttps://github.com/ceph/ceph/pull/60624/commits/919da3696668a07c6810dfa39301950c81c2eba4\nhttps://github.com/ceph/ceph/security/advisories/GHSA-5g9m-mmp6-93mq\nhttps://tracker.ceph.com/issues/68836"], "threat_severity": "Important"}