The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:4238 advisory.

    Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable     version of the Ceph storage system with a Ceph management platform, deployment utilities, and support     services.

    These new packages include numerous security and bug fixes. Space precludes documenting all of these     changes in this advisory. Users are directed to the Red Hat Ceph Storage Release Notes for information on     the most significant of these changes:

    https://docs.redhat.com/en/documentation/red_hat_ceph_storage/6/html/6.1_release_notes/index

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5825 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5825-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     December 06, 2024                     https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : ceph     CVE ID         : CVE-2023-43040 CVE-2024-48916

    Sage McTaggart discovered an authentication bypass in radosgw, the RADOS     REST gateway of Ceph, a distributed storage and file system.

    For the stable distribution (bookworm), these problems have been fixed in     version 16.2.15+ds-0+deb12u1.

    We recommend that you upgrade your ceph packages.

    For the detailed security status of ceph please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/ceph

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by a vulnerability as referenced in the USN-7182-1 advisory.

    It was discovered that Ceph incorrectly handled unsupported JWT algorithms in the RadosGW gateway. An     attacker could possibly use this issue to bypass certain authentication checks and restrictions.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of ceph installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-48916 advisory.

  - Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is     possible to send an JWT that has none as JWT alg. And by doing so the JWT signature is not checked. The     vulnerability is most likely in the RadosGW OIDC provider. As of time of publication, a known patched     version has yet to be published. (CVE-2024-48916)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:10956 advisory.

    Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable     version of the Ceph storage system with a Ceph management platform, deployment utilities, and support     services.

    These new packages include numerous enhancements, bug fixes, and known issues. Space precludes documenting     all of these changes in this advisory. Users are directed to the Red Hat Ceph Storage Release Notes for     information on the most significant of these changes:

    https://docs.redhat.com/en/documentation/red_hat_ceph_storage/8/html/8.0_release_notes

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:4664 advisory.

    Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable     version of the Ceph storage system with a Ceph management platform, deployment utilities, and support     services.

    These new packages include numerous enhancements, bug fixes, and known issues. Space precludes documenting     all of these changes in this advisory. Users are directed to the Red Hat Ceph Storage Release Notes for     information on the most significant of these changes:

    https://docs.redhat.com/en/documentation/red_hat_ceph_storage/7/html/7.1_release_notes

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
237014	RHEL 8 / 9 : Red Hat Ceph Storage 6.1 update (Important) (RHSA-2025:4238)	Nessus	Red Hat Local Security Checks	5/21/2025	6/5/2025	high
212141	Debian dsa-5825 : ceph - security update	Nessus	Debian Local Security Checks	12/6/2024	8/15/2025	critical
213501	Ubuntu 22.04 LTS / 24.04 LTS / 24.10 : Ceph vulnerability (USN-7182-1)	Nessus	Ubuntu Local Security Checks	1/6/2025	7/31/2025	high
247131	CBL Mariner 2.0 Security Update: ceph (CVE-2024-48916)	Nessus	MarinerOS Local Security Checks	8/10/2025	8/10/2025	high
212511	RHEL 9 : Red Hat Ceph Storage 8.0 (RHSA-2024:10956)	Nessus	Red Hat Local Security Checks	12/11/2024	7/31/2025	high
235495	RHEL 8 / 9 : Red Hat Ceph Storage 7.1 (RHSA-2025:4664)	Nessus	Red Hat Local Security Checks	5/7/2025	6/5/2025	medium

Detections

Analytics

Plugins Search

high

critical

high

high

high

medium