VDB
DEBIAN-CVE-2024-48916
DEBIAN-CVE-2024-48916
PUBLISHED
CVSS 8.100000381469727 HIGH
Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has "none" as JWT alg. And by doing so the JWT signature is not checked. The vulnerability is most likely in the RadosGW OIDC provider. As of time of publication, a known patched version has yet to be published.
Risk Scores
CVSS 3.1
8.100000381469727
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Debian:13 | ceph | 0 |
| Debian:12 | ceph | 0, 16.2.11+ds-2, 16.2.11+ds-3 |
| Debian:14 | ceph | 0 |
Timeline
- Jul 30, 2025 CVE Published
- Sep 15, 2026 CVE Updated