Linuxsecurity Multiple Security Flaws in Ceph Affecting Fedora 43 and 44
Article Content
- •CVE-2025-30156 allows authentication bypass in CephX due to AES-CBC misuse.
- •CVE-2026-39944 shares a root cause with CVE-2025-30156, indicating systemic issues.
- •Immediate updates are recommended for Fedora 43 and 44 to address these vulnerabilities.
Two significant security vulnerabilities have been identified in Ceph versions 19.2.6 and 20.2.4, affecting Fedora 43 and 44 respectively. CVE-2025-30156 is an authentication bypass in CephX caused by misuse of AES-CBC, while CVE-2026-39944 shares the same unauthenticated-encryption root cause. Additionally, CVE-2026-50152 presents an improper authorization flaw in the Ceph Monitor subscription handler, and CVE-2026-54330 involves RGW failing to verify SigV4 cryptographic signatures. These vulnerabilities could allow unauthorized access and manipulation of data stored in Ceph. Users are advised to update their systems immediately to mitigate these risks. The updates can be installed via the 'dnf' update program. Both advisories were published on August 22, 2026.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Following this threat?
Track Fedora and CVE-2025-30156 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active… 
CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…