2025-04-12
ALT-BU-2025-5512-1
Branch sisyphus_loongarch64 update bulletin.
Package ceph updated to version 19.2.2-alt1 for branch sisyphus_loongarch64.
Closed vulnerabilities
Published: 2024-11-05
BDU:2025-00001
Уязвимость демона radosgw системы хранения данных Ceph, позволяющая нарушителю обойти процедуру аутентификации
Severity: HIGH (8.1)
Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Severity: HIGH (8.5)
Vector: AV:N/AC:L/Au:S/C:C/I:C/A:N
References:
Published: 2025-07-30
Modified: 2025-07-31
Modified: 2025-07-31
CVE-2024-48916
Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has "none" as JWT alg. And by doing so the JWT signature is not checked. The vulnerability is most likely in the RadosGW OIDC provider. As of time of publication, a known patched version has yet to be published.
Severity: HIGH (8.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
References:
Package gpresult updated to version 0.0.5-alt1 for branch sisyphus_loongarch64.
Closed bugs
gpresult некорректно показывает версию групповой политики