[AUTO-CHERRYPICK] [AutoPR- Security] Patch ceph for CVE-2024-48916 [HIGH] - branch main (#14462)

Co-authored-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
Co-authored-by: Sudipta Pandit <sudpandit@microsoft.com>

Author: 3 people

SPECS/ceph/CVE-2024-48916.patch

@@ -0,0 +1,31 @@
+From 9f7c66fe0f5c85b3b986804cfc5a892f395aa50d Mon Sep 17 00:00:00 2001
+From: Pritha Srivastava <prsrivas@redhat.com>
+Date: Tue, 5 Nov 2024 12:03:00 +0530
+Subject: [PATCH] rgw/sts: fix to disallow unsupported JWT algorithms while
+ authenticating AssumeRoleWithWebIdentity using JWT obtained from an external
+ IDP.
+
+fixes: https://tracker.ceph.com/issues/68836
+
+Signed-off-by: Pritha Srivastava <prsrivas@redhat.com>
+---
+ src/rgw/rgw_rest_sts.cc | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/src/rgw/rgw_rest_sts.cc b/src/rgw/rgw_rest_sts.cc
+index af1b96ce0..b8d63448d 100644
+--- a/src/rgw/rgw_rest_sts.cc
++++ b/src/rgw/rgw_rest_sts.cc
+@@ -291,6 +291,9 @@ WebTokenEngine::validate_signature(const DoutPrefixProvider* dpp, const jwt::dec
+                               .allow_algorithm(jwt::algorithm::ps512{cert});
+ 
+                 verifier.verify(decoded);
++              } else {
++                ldpp_dout(dpp, 0) << "Unsupported algorithm: " << algorithm << dendl;
++                throw -EINVAL;
+               }
+             } catch (std::runtime_error& e) {
+               ldpp_dout(dpp, 0) << "Signature validation failed: " << e.what() << dendl;
+-- 
+2.45.4
+

SPECS/ceph/ceph.spec

@@ -5,7 +5,7 @@
 Summary:        User space components of the Ceph file system
 Name:           ceph
 Version:        16.2.10
-Release:        8%{?dist}
+Release:        9%{?dist}
 License:        LGPLv2 and LGPLv3 and CC-BY-SA and GPLv2 and Boost and BSD and MIT and Public Domain and GPLv3 and ASL-2.0
 URL:            https://ceph.io/
 Vendor:         Microsoft Corporation
@@ -19,6 +19,7 @@ Patch4:         CVE-2023-43040.patch
 Patch5:         CVE-2024-38517.patch
 Patch6:		CVE-2025-1744.patch
 Patch7:         CVE-2025-52939.patch
+Patch8:         CVE-2024-48916.patch
 # 
 # Copyright (C) 2004-2019 The Ceph Project Developers. See COPYING file
 # at the top-level directory of this distribution and at
@@ -1814,6 +1815,9 @@ exit 0
 %config %{_sysconfdir}/prometheus/ceph/ceph_default_alerts.yml
 
 %changelog
+* Fri Aug 01 2025 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 16.2.10-9
+- Patch for CVE-2024-48916
+
 * Tue Jul 01 2025 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 16.2.10-8
 - Patch for CVE-2025-52939