The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions     prior to 20.2.4 and 19.2.6, the CephX authentication protocol encrypts tickets with AES-128-CBC in an     unauthenticated mode that uses a hard-coded initialization vector and no message authentication, allowing     an attacker to forge credentials and gain cluster-wide access. Because the ciphertext is malleable and the     monitor will encrypt attacker-chosen entity names, an attacker holding one low-privilege key and able to     observe CephX traffic can use the monitor as an encryption oracle and splice ciphertext blocks into valid     tickets for privileged entities such as Manager, MDS, and OSD. The same lack of authentication also lets     an attacker with CephX permissions escalate privileges by flipping a single bit in a service ticket to set     its allow_all field to true. This issue is fixed in versions 20.2.4 and 19.2.6. (CVE-2025-30156)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2025-30156

high Nessus Plugin ID 338279

Version 1.4