packages/ceph
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

!285 fix-CVE-2024-48916

Browse Source 
From: @wangzengliang1 
Reviewed-by: @liuqinfei 
Signed-off-by: @liuqinfei
This commit is contained in:
openeuler-ci-bot 2025-02-24 06:22:39 +00:00 committed by Gitee
commit a537dadcac
No known key found for this signature in database
GPG Key ID: 173E9B9CA92EEF8F
2 changed files with 38 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
0018-fix-CVE-2024-48916.patch Normal file
View File

@ -0,0 +1,33 @@
From d543770ca4c0ae6a9882cb5796298d9240f42e6f Mon Sep 17 00:00:00 2001
From: wangzengliang1 <wangzengliang2@huawei.com>
Date: Mon, 20 Jan 2025 11:05:26 +0800
Subject: [PATCH] cve-2024-48916
copyed-by: https://github.com/ceph/ceph/pull/60624
while authenticating AssumeRoleWithWebIdentity using JWT obtained
from an external IDP.
fixes: https://tracker.ceph.com/issues/68836
Signed-off-by Pritha Srivastava <prsrivas@redhat.com>
---
src/rgw/rgw_rest_sts.cc | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/src/rgw/rgw_rest_sts.cc b/src/rgw/rgw_rest_sts.cc
index af1b96c..9c24c68 100644
--- a/src/rgw/rgw_rest_sts.cc
+++ b/src/rgw/rgw_rest_sts.cc
@@ -291,7 +291,11 @@ WebTokenEngine::validate_signature(const DoutPrefixProvider* dpp, const jwt::dec
.allow_algorithm(jwt::algorithm::ps512{cert});
verifier.verify(decoded);
+ } else {
+ ldpp_dout(dpp, 0) << "Unsupported algorithm: " << algorithm << dendl;
+ throw -EINVAL;
}
+
} catch (std::runtime_error& e) {
ldpp_dout(dpp, 0) << "Signature validation failed: " << e.what() << dendl;
throw;
--
1.8.3.1

6
ceph.spec
View File

@ -125,7 +125,7 @@
#################################################################################
Name: ceph
Version: 16.2.7
Release: 21
Release: 22
%if 0%{?fedora} || 0%{?rhel} || 0%{?openEuler}
Epoch: 2
%endif
@ -160,6 +160,7 @@ Patch14: 0014-fix-CVE-2022-3854.patch
Patch15: 0015-ceph-volume-add-judgment-for-ceph-volume-lvm-activat.patch
Patch16: 0016-fix-CVE-2023-46159.patch
Patch17: 0017-fix-osd-activate-error-when-node-reboot.patch
Patch18: 0018-fix-CVE-2024-48916.patch
%if 0%{?suse_version}
# _insert_obs_source_lines_here
ExclusiveArch: x86_64 aarch64 ppc64le s390x
@ -2504,6 +2505,9 @@ exit 0
%config %{_sysconfdir}/prometheus/ceph/ceph_default_alerts.yml
%changelog
* Fri Feb 21 2025 wangzengliang <wangzengliang2@huawei.com> - 2:16.2.7-22
- fix-CVE-2024-48916.patch
* Fri Nov 01 2024 yangxiaoliang <yangxiaoliang@uniontech.com> - 2:16.2.7-21
- fix osd activate error when node reboot