CVE-2025-30156

Public on 2026-08-21
Modified on 2026-08-21
Description
Authentication bypass in Ceph's CephX implementation. CephX's AES-128-CBC encryption is unauthenticated. It has no HMAC, and it uses a hard-coded initialization vector. (from https://github.com/ceph/ceph/security/advisories/GHSA-7q3q-3975-qw3q)
Severity
Important severity
Important
See what this means
CVSS v3 Base Score
8.9
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 2 - Core ceph-common Pending Fix

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 8.9 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

References

FAQs regarding Amazon Linux ALAS/CVE Severity Red Hat: CVE-2025-30156 Mitre: CVE-2025-30156