https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 08:36:18 +0000 https://cve.radiocsirt.org/vuln/bdu:2025-00001 bdu:2025-00001 https://cve.radiocsirt.org/vuln/bdu:2025-00001 https://cve.radiocsirt.org/vuln/bit-ceph-2024-48916 <p><strong>Affected:</strong> Bitnami: ceph</p> <p>Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has &#34;none&#34; as JWT alg. And by doing so the JWT signature is not checked. The vulnerability is most likely in the RadosGW OIDC provider. As of time of publication, a known patched version has yet to be published.</p> <p><strong>Affected:</strong> Bitnami: ceph</p> <p>Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has &#34;none&#34; as JWT alg. And by doing so the JWT signature is not checked. The vulnerability is most likely in the RadosGW OIDC provider. As of time of publication, a known patched version has yet to be published.</p> https://cve.radiocsirt.org/vuln/bit-ceph-2024-48916 https://cve.radiocsirt.org/vuln/euvd-2026-248751 EUVD-2026-248751 https://cve.radiocsirt.org/vuln/euvd-2026-248751 https://cve.radiocsirt.org/vuln/fkie_cve-2024-48916 <p>Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has &#34;none&#34; as JWT alg. And by doing so the JWT signature is not checked. The vulnerability is most likely in the RadosGW OIDC provider. As of time of publication, a known patched version has yet to be published.</p> <p>Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has &#34;none&#34; as JWT alg. And by doing so the JWT signature is not checked. The vulnerability is most likely in the RadosGW OIDC provider. As of time of publication, a known patched version has yet to be published.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-48916 https://cve.radiocsirt.org/vuln/msrc_cve-2024-48916 msrc_CVE-2024-48916 https://cve.radiocsirt.org/vuln/msrc_cve-2024-48916 https://cve.radiocsirt.org/vuln/oesa-2025-1206 <p><strong>Affected:</strong> openEuler:22.03-LTS-SP4: ceph</p> <p>Ceph is a massively scalable, open-source, distributed storage system that runs on commodity hardware and delivers object, block and file system storage. Security Fix(es):</p> <p>A vulnerability in the Ceph Rados Gateway (RadosGW) OIDC provider allows attackers to bypass JWT signature verification by supplying a token with &amp;quot;none&amp;quot; as the algorithm (alg). This occurs because the implementation fails to enforce strict signature validation, enabling attackers to forge valid tokens without a signature.(CVE-2024-48916)</p> <p><strong>Affected:</strong> openEuler:22.03-LTS-SP4: ceph</p> <p>Ceph is a massively scalable, open-source, distributed storage system that runs on commodity hardware and delivers object, block and file system storage. Security Fix(es):</p> <p>A vulnerability in the Ceph Rados Gateway (RadosGW) OIDC provider allows attackers to bypass JWT signature verification by supplying a token with &amp;quot;none&amp;quot; as the algorithm (alg). This occurs because the implementation fails to enforce strict signature validation, enabling attackers to forge valid tokens without a signature.(CVE-2024-48916)</p> https://cve.radiocsirt.org/vuln/oesa-2025-1206 https://cve.radiocsirt.org/vuln/rhsa-2024:10956 <p>ceph: rhceph-container: Authentication bypass in CEPH RadosGW</p> <p>ceph: rhceph-container: Authentication bypass in CEPH RadosGW</p> https://cve.radiocsirt.org/vuln/rhsa-2024:10956 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-48916 <p><strong>Affected:</strong> Ubuntu:22.04:LTS: ceph, Ubuntu:24.04:LTS: ceph</p> <p>Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has &#34;none&#34; as JWT alg. And by doing so the JWT signature is not checked. The vulnerability is most likely in the RadosGW OIDC provider. As of time of publication, a known patched version has yet to be published.</p> <p><strong>Affected:</strong> Ubuntu:22.04:LTS: ceph, Ubuntu:24.04:LTS: ceph</p> <p>Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has &#34;none&#34; as JWT alg. And by doing so the JWT signature is not checked. The vulnerability is most likely in the RadosGW OIDC provider. As of time of publication, a known patched version has yet to be published.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-48916 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-3688 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux (Ceph Storage) ausnutzen, um Sicherheitsvorkehrungen zu umgehen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux (Ceph Storage) ausnutzen, um Sicherheitsvorkehrungen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-3688