Ceph is a distributed object, block, and file storage platform. In versions up to and including 19.2.3, using the argument `x-amz-copy-source` to put an object and specifying an empty string as its content leads to the RGW daemon crashing, resulting in a DoS attack. As of time of publication, no known patched versions exist.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:2769 advisory.

    Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable     version of the Ceph storage system with a Ceph management platform, deployment utilities, and support     services.

    These new packages include numerous security and bug fixes. Space precludes documenting all of these     changes in this advisory. Users are directed to the Red Hat Ceph Storage Release Notes for information on     the most significant of these changes:

    https://docs.redhat.com/en/documentation/red_hat_ceph_storage/7/html/7.1_release_notes

    ==========================================     IMPORTANT:
    The Red Hat Ceph Storage team has migrated our defect tracking from Bugzilla to an internal Jira system.
    Bug fixes and CVE information that was previously listed in the errata releases are now listed in the     Release Notes.

    During the migration period, some defect details might still appear temporarily in the Errata. However,     the release notes contain the most current and authoritative information, including the complete list of     fixes and security updates.

    Refer to the release notes going forward for the latest and most accurate fix and CVE information.
    ==========================================

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4460 advisory.

    - -----------------------------------------------------------------------     Debian LTS Advisory DLA-4460-1              debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Utkarsh Gupta     February 01, 2026                           https://wiki.debian.org/LTS
    - -----------------------------------------------------------------------

    Package        : ceph     Version        : 14.2.21-1+deb11u2     CVE ID         : CVE-2022-0670 CVE-2024-47866     Debian Bug     : 1016069 1120797

    Ceph is a distributed object, block, and file storage platform.

    CVE-2022-0670

        A flaw was found in Openstack manilla owning a Ceph File system         share, which enables the owner to read/write any manilla share         or entire file system. The vulnerability is due to a bug in the         volumes plugin in Ceph Manager. This allows an attacker to         compromise confidentiality and integrity of a file system.

    CVE-2024-47866

        Using the argument `x-amz-copy-source` to put an object and         specifying an empty string as its content leads to the RGW daemon         crashing, resulting in a DoS attack.

    For Debian 11 bullseye, these problems have been fixed in version     14.2.21-1+deb11u2.

    We recommend that you upgrade your ceph packages.

    For the detailed security status of ceph please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/ceph

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Ceph is a distributed object, block, and file storage platform. In versions up to and including 19.2.3,     using the argument `x-amz-copy-source` to put an object and specifying an empty string as its content     leads to the RGW daemon crashing, resulting in a DoS attack. As of time of publication, no known patched     versions exist. (CVE-2024-47866)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:21068 advisory.

    Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable     version of the Ceph storage system with a Ceph management platform, deployment utilities, and support     services.

    These new packages includes numerous bug fixes. Space precludes documenting all of these changes in this     advisory. Users are directed to the Red Hat Ceph Storage Release Notes for information on the most     significant of these changes:

    https://docs.redhat.com/en/documentation/red_hat_ceph_storage/8/html/8.1_release_notes

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
299273	RHEL 8 / 9 : Red Hat Ceph Storage 7.1 (RHSA-2026:2769)	Nessus	Red Hat Local Security Checks	high
297490	Debian dla-4460 : ceph - security update	Nessus	Debian Local Security Checks	critical
275346	Linux Distros Unpatched Vulnerability : CVE-2024-47866	Nessus	Misc.	high
275157	RHEL 9 : Red Hat Ceph Storage 8.1 update (Important) (RHSA-2025:21068)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2024-47866

high

Tenable Plugins

high

critical

high

medium