HCE2-SA-2025-0148 Important HCE 2.0 Security Fix(es): A vulnerability in the Ceph Rados Gateway (RadosGW) OIDC provider allows attackers to bypass JWT signature verification by supplying a token with "none" as the algorithm (alg). This occurs because the implementation fails to enforce strict signature validation, enabling attackers to forge valid tokens without a signature. (CVE-2024-48916) HCE 2.0 libcephfs2-16.2.7-18.r4.hce2.aarch64.rpm libcephfs-devel-16.2.7-18.r4.hce2.aarch64.rpm libcephsqlite-16.2.7-18.r4.hce2.aarch64.rpm libcephsqlite-devel-16.2.7-18.r4.hce2.aarch64.rpm librados2-16.2.7-18.r4.hce2.aarch64.rpm libradospp-devel-16.2.7-18.r4.hce2.aarch64.rpm libradosstriper1-16.2.7-18.r4.hce2.aarch64.rpm libradosstriper-devel-16.2.7-18.r4.hce2.aarch64.rpm librados-devel-16.2.7-18.r4.hce2.aarch64.rpm librbd1-16.2.7-18.r4.hce2.aarch64.rpm librbd-devel-16.2.7-18.r4.hce2.aarch64.rpm librgw2-16.2.7-18.r4.hce2.aarch64.rpm librgw-devel-16.2.7-18.r4.hce2.aarch64.rpm rados-objclass-devel-16.2.7-18.r4.hce2.aarch64.rpm libcephfs2-16.2.7-18.r4.hce2.x86_64.rpm libcephfs-devel-16.2.7-18.r4.hce2.x86_64.rpm libcephsqlite-16.2.7-18.r4.hce2.x86_64.rpm libcephsqlite-devel-16.2.7-18.r4.hce2.x86_64.rpm librados2-16.2.7-18.r4.hce2.x86_64.rpm libradospp-devel-16.2.7-18.r4.hce2.x86_64.rpm libradosstriper1-16.2.7-18.r4.hce2.x86_64.rpm libradosstriper-devel-16.2.7-18.r4.hce2.x86_64.rpm librados-devel-16.2.7-18.r4.hce2.x86_64.rpm librbd1-16.2.7-18.r4.hce2.x86_64.rpm librbd-devel-16.2.7-18.r4.hce2.x86_64.rpm librgw2-16.2.7-18.r4.hce2.x86_64.rpm librgw-devel-16.2.7-18.r4.hce2.x86_64.rpm rados-objclass-devel-16.2.7-18.r4.hce2.x86_64.rpm