From 6dddeccd52e5d2440beb8248a905a0588666e6d1 Mon Sep 17 00:00:00 2001 From: Pritha Srivastava Date: Tue, 5 Nov 2024 12:03:00 +0530 Subject: [PATCH] [CVE-2024-48916] rgw/sts: fix to disallow unsupported JWT algorithms while authenticating AssumeRoleWithWebIdentity using JWT obtained from an external IDP. fixes: https://tracker.ceph.com/issues/68836 Signed-off-by: Pritha Srivastava (cherry picked from commit 919da3696668a07c6810dfa39301950c81c2eba4) --- src/rgw/rgw_rest_sts.cc | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/rgw/rgw_rest_sts.cc b/src/rgw/rgw_rest_sts.cc index 09f77f61d5f..23328236ab9 100644 --- a/src/rgw/rgw_rest_sts.cc +++ b/src/rgw/rgw_rest_sts.cc @@ -444,6 +444,9 @@ WebTokenEngine::validate_signature(const DoutPrefixProvider* dpp, const jwt::dec .allow_algorithm(jwt::algorithm::ps512{cert}); verifier.verify(decoded); + } else { + ldpp_dout(dpp, 0) << "Unsupported algorithm: " << algorithm << dendl; + throw -EINVAL; } } catch (std::runtime_error& e) { ldpp_dout(dpp, 0) << "Signature validation failed: " << e.what() << dendl; -- 2.39.5