ceph: rhceph-container: Authentication bypass in CEPH RadosGW

A vulnerability in the Ceph Rados Gateway RadosGW OIDC provider allows attackers to bypass JWT signature verification by supplying a token with "none" as the algorithm alg. This occurs because the implementation fails to enforce strict signature validation, enabling attackers to forge valid token...

Important: Red Hat Security Advisory: Red Hat Ceph Storage 8.0 security update

An update is now available for Red Hat Ceph Storage 8.0. Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable version of the Ceph storage system with a Ceph management platform, deployment utilities, and support services. These new packages...

Important: Red Hat Security Advisory: Updated 8.0 container image is now available in the Red Hat Ecosystem Catalog.

Updated rhceph-8.0 container image is now available in the Red Hat Ecosystem Catalog. Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable version of the Ceph storage system with a Ceph management platform, deployment utilities, and support...

RHEL 9 : Red Hat Ceph Storage 8.0 (RHSA-2024:10956)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:10956 advisory. Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable version of the Ceph storage system with a...

The vulnerability of the ceph kernel component in the Linux operating system, which allows a hacker to trigger a service failure

The vulnerability of the ceph kernel component in the Linux operating system is related to the lack of memory release after the effective lifespan of the component. Exploiting this vulnerability can allow an attacker to cause a service failure...

Debian: Security Advisory (DSA-5825-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DSA 5825-1] ceph security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5825-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff December 06, 2024 https://www.debian.org/security/faq -...

DSA-5825-1 ceph - security update

Bulletin has no description...

Debian dsa-5825 : ceph - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5825 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-5825-1 [email protected] https://www.debian.org/securit...

PT-2024-37022

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak issue has been resolved in the Linux kernel, specifically in the ceph direct read/write functionality. The bvecs array, allocated in iter get bvecs alloc, is leaked and pag...

SUSE CVE-2024-48916

Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has "none" as JWT alg. And by doing so the JWT signature is not checked. The vulnerability is most likely in the RadosGW OIDC provider. As of time of publication, a kno...

CBL Mariner 2.0 Security Update: ceph (CVE-2021-28361)

The version of ceph installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-28361 advisory. - An issue was discovered in Storage Performance Development Kit SPDK before 20.01.01. If a PDU is sent to the...

CVE-2024-48916

Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has "none" as JWT alg. And by doing so the JWT signature is not checked. The vulnerability is most likely in the RadosGW OIDC provider. As of time of publication, a kno...

UBUNTU-CVE-2024-48916

Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has "none" as JWT alg. And by doing so the JWT signature is not checked. The vulnerability is most likely in the RadosGW OIDC provider. As of time of publication, a kno...

CBL Mariner 2.0 Security Update: CBL-Mariner Releases / ceph / zstd (CVE-2021-24032)

The version of CBL-Mariner Releases / ceph / zstd installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-24032 advisory. - Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for...

CVE-2024-48916

A vulnerability in the Ceph Rados Gateway RadosGW OIDC provider allows attackers to bypass JWT signature verification by supplying a token with "none" as the algorithm alg. This occurs because the implementation fails to enforce strict signature validation, enabling attackers to forge valid token...

Red Hat Ceph Storage 数据伪造问题漏洞

Red Hat Ceph Storage is a suite of scalable, open software-defined storage platforms from Red Hat USA. A data forgery issue vulnerability exists in Red Hat Ceph Storage that stems from the presence of an authentication bypass...

PT-2024-36869

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been resolved by passing a cred pointer to ceph mds auth match. This change eliminates a redundant get current cred call, as ceph mds check access...

PT-2024-41789

Уязвимость функции ceph mds check access модуля fs/ceph/mds client.c поддержки распределенной файловой системы Ceph ядра операционной системы Linux связана с ошибками при обновлении счетчика ссылок. Эксплуатация уязвимости может позволить нарушителю получить несанкционированный доступ к защищаемо...

PT-2024-36868

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A credential leak issue has been resolved in the Linux kernel. The problem occurred because get current cred increments the reference counter, but the corresponding put cred call was...