Your message dated Fri, 21 Aug 2026 16:49:13 +0000
with message-id <[email protected]>
and subject line Bug#1144947: fixed in ceph 20.2.4+ds-1
has caused the Debian Bug report #1144947,
regarding ceph: CVE-2025-30156 CVE-2026-39944 CVE-2026-50152 CVE-2026-54330
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1144947: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1144947
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: ceph
Version: 20.2.2+ds-13
Severity: grave
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerabilities were published for ceph, filling to be
on safe side as RC, maybe we can update to 20.2.4 to unstable
straight?
CVE-2025-30156[0], CVE-2026-39944[1], CVE-2026-50152[2],
CVE-2026-54330[3].
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2025-30156
https://www.cve.org/CVERecord?id=CVE-2025-30156
[1] https://security-tracker.debian.org/tracker/CVE-2026-39944
https://www.cve.org/CVERecord?id=CVE-2026-39944
[2] https://security-tracker.debian.org/tracker/CVE-2026-50152
https://www.cve.org/CVERecord?id=CVE-2026-50152
[3] https://security-tracker.debian.org/tracker/CVE-2026-54330
https://www.cve.org/CVERecord?id=CVE-2026-54330
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: ceph
Source-Version: 20.2.4+ds-1
Done: Daniel Baumann <[email protected]>
We believe that the bug you reported is fixed in the latest version of
ceph, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Daniel Baumann <[email protected]> (supplier of updated ceph package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 21 Aug 2026 17:02:48 +0200
Source: ceph
Architecture: source
Version: 20.2.4+ds-1
Distribution: sid
Urgency: high
Maintainer: Ceph Packaging Team <[email protected]>
Changed-By: Daniel Baumann <[email protected]>
Closes: 1144947
Changes:
ceph (20.2.4+ds-1) sid; urgency=high
.
* Merging upstream version 20.2.4+ds (Closes: #1144947):
- A flaw was found in the CephX authentication protocol [CVE-2025-30156]:
.
CephX uses AES-128-CBC encryption with a hardcoded initialization vector
and no message authentication (HMAC), making it vulnerable to the same
class of unauthenticated-encryption attacks that compromised Kerberos 4
as
documented in MIT's 2004 PERILS paper. An attacker who has compromised a
single low-privilege CephX entity key can use the Ceph monitor as an
encryption oracle by requesting tickets for specially-named entity
identities over a standard network connection. The monitor encrypts these
attacker-controlled names into ciphertext blocks which, due to absent
integrity protection, can be spliced into forged credentials for
privileged entities such as OSDs, MDSs, and MGRs. This grants
cluster-wide
access including data reads, data corruption, and full administrative
control.
.
- A flaw was found in Ceph RGW's STS (Security Token Service) session token
implementation [CVE-2026-39944]:
.
The STS tokens use the same unauthenticated AES-128-CBC encryption as
CephX, which lacks message authentication and uses a hardcoded
initialization vector. Because there is no integrity protection on the
tokens, an attacker who holds any valid unprivileged STS token can
perform
a CBC bit-flip attack to modify the token contents and escalate to full
RGW admin privileges. This requires only that STS is enabled
(rgw_s3_auth_use_sts = true) and that the attacker has a single valid STS
token. Successful exploitation grants complete control over the RGW
service, including reading, writing, and deleting all objects and buckets
.
- A flaw was found in the MON subscription handler of Ceph
[CVE-2026-50152]:
.
The handler does not properly authorize access to the config-key store
when processing MMonSubscribe messages. Any CephX user holding mon allow
r capabilities can read the entire config-key store, which contains
sensitive operational secrets including OSD LUKS disk encryption
passphrases and, on clusters managed by cephadm, the SSH private key used
to administer every host. Exposure of these secrets can lead to full
host-level root access and compromise of encrypted data at rest.
.
- A flaw was found in Ceph RGW's SigV4 signature verification handler
[CVE-2026-54330]:
.
When processing S3 requests, RGW verifies only the headers explicitly
listed in the X-Amz-SignedHeaders field but does not reject requests that
carry additional unsigned x-amz-* headers. This diverges from the AWS S3
specification, which requires all x-amz-* headers to be signed. As a
result, anyone holding a presigned PUT URL can attach arbitrary unsigned
x-amz-* headers that RGW will honor, effectively escalating their
privileges beyond what the original URL signer authorized. This can lead
to unauthorized access to and modification of S3 objects.
.
* Updating files excluded in copyright file.
* Updating 20.2.2+ds-13 changelog to match git history.
* Updating do-not-search-for-boost-system.patch for new upstream
version.
* Moving debian specific patches to debian subdirectory within
debian/patches.
* Cherry-picking patches from upstream to fix FTBFS with gcc-16.
* Refreshing common-Formatter-Include-cstdint.patch.
* Cherry-picking patch from upstream to fix FTBFS linking rgw.
Checksums-Sha1:
4b46de1f0674cc429118dcd01d63a14cb7c8fdae 9276 ceph_20.2.4+ds-1.dsc
bb68db8039080ea7b16b5e09c55bfacc161ad064 245630284 ceph_20.2.4+ds.orig.tar.xz
8c64f8c69bb247b91bdfe5240b3d3dab49c8dafa 149280 ceph_20.2.4+ds-1.debian.tar.xz
fc73c5080035871b8106181ca75b56a06ae2b660 47400 ceph_20.2.4+ds-1_amd64.buildinfo
Checksums-Sha256:
d2d39d6568cd916a80ea6bca0dab593673aecbc8fe3175927fb048012a9d00f3 9276
ceph_20.2.4+ds-1.dsc
190b4ca726717069b1d85b613aab99f9976a488129352a66a5ff41ada5d06730 245630284
ceph_20.2.4+ds.orig.tar.xz
51137d2665505fc1f073f93a049c49b81d0dd038e5d664415e1e21c14a3fec55 149280
ceph_20.2.4+ds-1.debian.tar.xz
dd24e33a7ebac8b1b0ebfa26ddb03a5027f72c6c053d4c4965f03f2ac46598c1 47400
ceph_20.2.4+ds-1_amd64.buildinfo
Files:
554413b76b43c946ceb289c1bd4ccc4f 9276 admin optional ceph_20.2.4+ds-1.dsc
146d3613ac6ba34378670ce279268525 245630284 admin optional
ceph_20.2.4+ds.orig.tar.xz
d31d8e0148ebbee27c2d962e3f989998 149280 admin optional
ceph_20.2.4+ds-1.debian.tar.xz
753b3952bd00f95db0d9df952854f81c 47400 admin optional
ceph_20.2.4+ds-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iHUEARYKAB0WIQQmmGg4gLaoSj0ERgL7tPDoCoAiLwUCaoh6BgAKCRD7tPDoCoAi
L60WAQCbCQ4swpJLTCYIxWpzArGXX1PqqjEwhzbfNW3gsGln9wEA+foY1RYy5wLH
8eLXjM4h9KofT649+e+zgScokztuuQI=
=WPCQ
-----END PGP SIGNATURE-----
pgpCTQTgVAjet.pgp
Description: PGP signature
--- End Message ---
