From 22b362ab9c7f72463f35addff53b34e301604104 Mon Sep 17 00:00:00 2001 From: wangzengliang1 Date: Sat, 28 Dec 2024 11:24:36 +0800 Subject: [PATCH] fix CVE-2024-48916 copyed-by: https://github.com/ceph/ceph/pull/60624 while authenticating AssumeRoleWithWebIdentity using JWT obtained from an external IDP. fixes: https://tracker.ceph.com/issues/68836 Signed-off-by Pritha Srivastava --- src/rgw/rgw_rest_sts.cc | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/rgw/rgw_rest_sts.cc b/src/rgw/rgw_rest_sts.cc index 09f77f6..878edc6 100644 --- a/src/rgw/rgw_rest_sts.cc +++ b/src/rgw/rgw_rest_sts.cc @@ -444,7 +444,11 @@ WebTokenEngine::validate_signature(const DoutPrefixProvider* dpp, const jwt::dec .allow_algorithm(jwt::algorithm::ps512{cert}); verifier.verify(decoded); + } else { + ldpp_dout(dpp, 0) << "Unsupported algorithm: " << algorithm << dendl; + throw -EINVAL; } + } catch (std::runtime_error& e) { ldpp_dout(dpp, 0) << "Signature validation failed: " << e.what() << dendl; throw; -- 1.8.3.1