CVE-2025-30156
- Source
- https://cve.org/CVERecord?id=CVE-2025-30156
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-30156.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-30156
- Aliases
-
- GHSA-7q3q-3975-qw3q
- Downstream
- Published
- 2026-08-27T20:34:41.822Z
- Modified
- 2026-08-29T08:12:54.680027Z
- Severity
-
- 8.9 (High) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L CVSS Calculator
- Summary
- Ceph: AES-CBC misuse in CephX and RADOSGW enables authentication bypass and credential forgery
- Details
-
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the CephX authentication protocol encrypts tickets with AES-128-CBC in an unauthenticated mode that uses a hard-coded initialization vector and no message authentication, allowing an attacker to forge credentials and gain cluster-wide access. Because the ciphertext is malleable and the monitor will encrypt attacker-chosen entity names, an attacker holding one low-privilege key and able to observe CephX traffic can use the monitor as an encryption oracle and splice ciphertext blocks into valid tickets for privileged entities such as Manager, MDS, and OSD. The same lack of authentication also lets an attacker with CephX permissions escalate privileges by flipping a single bit in a service ticket to set its allow_all field to true. This issue is fixed in versions 20.2.4 and 19.2.6.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30156.json", "cwe_ids": [ "CWE-327" ], "cna_assigner": "GitHub_M" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30156.json
- https://github.com/ceph/ceph/security/advisories/GHSA-7q3q-3975-qw3q
- https://nvd.nist.gov/vuln/detail/CVE-2025-30156
- https://github.com/ceph/ceph/commit/2ba086255de09c8b95177717cc7e9dd4377e2f0f
- https://github.com/ceph/ceph/commit/3078188a7bdd89e2975280f2a906c71c2f6effd6
Affected packages
Git / github.com/ceph/ceph
Affected ranges
- Type
- GIT
- Repo
- https://github.com/ceph/ceph
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedIntroducedFixedFixedFixedFixed
- Database specific
-
Show details
{ "source": [ "AFFECTED_FIELD", "REFERENCES" ], "extracted_events": [ { "introduced": "0" }, { "fixed": "19.2.6" }, { "introduced": "20.0.0" }, { "fixed": "20.2.4" } ] }
Affected versions
v0.*
v0.1
v0.18
v0.19
v0.2
v0.4
v0.5
v0.6
v0.7.1
v0.7.2
v0.7.3
v0.9
v11.*
v11.0.0
v13.*
v13.0.0
v14.*
v14.0.0
v15.*
v15.0.0
v16.*
v16.0.0
v17.*
v17.0.0
v18.*
v18.0.0
v19.*
v19.0.0
v19.2.5
v20.*
v20.0.0
v20.2.3
Database specific
vanir_signatures
[
{
"id": "CVE-2025-30156-032c5974",
"target": {
"function": "TEST",
"file": "src/test/crypto.cc"
},
"deprecated": false,
"digest": {
"function_hash": "96129151437415389453052484007555442942",
"length": 1146.0
},
"signature_version": "v1",
"source": "https://github.com/ceph/ceph/commit/3078188a7bdd89e2975280f2a906c71c2f6effd6",
"signature_type": "Function"
},
{
"id": "CVE-2025-30156-1966c4fe",
"target": {
"file": "src/common/ceph_context.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"238083509200992647035337257821584571180",
"203634782045995963188738421552407186338",
"87135994561140433136218889491289898181",
"9186890098152610663510812762657628244"
]
},
"signature_version": "v1",
"source": "https://github.com/ceph/ceph/commit/3078188a7bdd89e2975280f2a906c71c2f6effd6",
"signature_type": "Line"
},
{
"id": "CVE-2025-30156-3d0c4379",
"target": {
"function": "aes_loop",
"file": "src/test/crypto.cc"
},
"deprecated": false,
"digest": {
"function_hash": "71465742050219093393176232472031099487",
"length": 925.0
},
"signature_version": "v1",
"source": "https://github.com/ceph/ceph/commit/2ba086255de09c8b95177717cc7e9dd4377e2f0f",
"signature_type": "Function"
},
{
"id": "CVE-2025-30156-4f7e4c2f",
"target": {
"function": "TEST",
"file": "src/test/crypto.cc"
},
"deprecated": false,
"digest": {
"function_hash": "107879702574115735810233433907646763595",
"length": 1383.0
},
"signature_version": "v1",
"source": "https://github.com/ceph/ceph/commit/2ba086255de09c8b95177717cc7e9dd4377e2f0f",
"signature_type": "Function"
},
{
"id": "CVE-2025-30156-52187d30",
"target": {
"function": "crush_location",
"file": "src/common/ceph_context.cc"
},
"deprecated": false,
"digest": {
"function_hash": "184966053259235643985708475743101066455",
"length": 3825.0
},
"signature_version": "v1",
"source": "https://github.com/ceph/ceph/commit/2ba086255de09c8b95177717cc7e9dd4377e2f0f",
"signature_type": "Function"
},
{
"id": "CVE-2025-30156-55163390",
"target": {
"file": "src/common/ceph_context.cc"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"41578653565868220279074809210998337438",
"93960078015615237875598891237883924386",
"158656258918753961787405445641267447210",
"77710679716358428638341804348728265765",
"185583858511315330129761845596152542171",
"235327743169536103610999597422691414918",
"18911565863761327200080632888548720781",
"188034010088706660436907698721945202424",
"185050653075051856001785083829664450638",
"40077328877534928062939153103586413270",
"66117929726710822380486926616002479016",
"215189374563737888949416880874566574628",
"145657690986678003689917577419569838328",
"244114983507801607400745851226527344676",
"1079364570786715084158330140198981237",
"316568526608998959928294922061184162313"
]
},
"signature_version": "v1",
"source": "https://github.com/ceph/ceph/commit/2ba086255de09c8b95177717cc7e9dd4377e2f0f",
"signature_type": "Line"
},
{
"id": "CVE-2025-30156-55ac7561",
"target": {
"function": "aes_loop_cephx",
"file": "src/test/crypto.cc"
},
"deprecated": false,
"digest": {
"function_hash": "114693090093363723641586779589274432617",
"length": 945.0
},
"signature_version": "v1",
"source": "https://github.com/ceph/ceph/commit/3078188a7bdd89e2975280f2a906c71c2f6effd6",
"signature_type": "Function"
},
{
"id": "CVE-2025-30156-591e0c49",
"target": {
"file": "src/auth/Crypto.cc"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"177065758090945851760449931674968841613",
"331694157586539836095392699590762109549",
"104045194296170142597570009514128019608",
"3972226125149754121327617198140429636",
"140473611810058361559931965535436877873",
"328475466762456077190779883530616043104",
"65109808503123295828418150447019093914",
"279834661296888747033828989242607763234",
"151105975094477800593598896244710238128",
"120280614403958812553613970619131026422",
"29237170902168267656570740813250942821",
"309903494677136292993624764576081364140",
"261938605169989597328512841121943244217",
"17017770065630453403899661629935446353",
"277248954865975091565161151554749029578",
"243451910281469811235287050556734824207",
"76401396019973569264525829383983105760"
]
},
"signature_version": "v1",
"source": "https://github.com/ceph/ceph/commit/2ba086255de09c8b95177717cc7e9dd4377e2f0f",
"signature_type": "Line"
},
{
"id": "CVE-2025-30156-5e6145e3",
"target": {
"function": "TEST",
"file": "src/test/crypto.cc"
},
"deprecated": false,
"digest": {
"function_hash": "135467422423782816164285439193430693930",
"length": 1180.0
},
"signature_version": "v1",
"source": "https://github.com/ceph/ceph/commit/2ba086255de09c8b95177717cc7e9dd4377e2f0f",
"signature_type": "Function"
},
{
"id": "CVE-2025-30156-61623dcd",
"target": {
"function": "CephContext::get_crypto_handler",
"file": "src/common/ceph_context.cc"
},
"deprecated": false,
"digest": {
"function_hash": "163578604243263679140065647037354139449",
"length": 196.0
},
"signature_version": "v1",
"source": "https://github.com/ceph/ceph/commit/2ba086255de09c8b95177717cc7e9dd4377e2f0f",
"signature_type": "Function"
},
{
"id": "CVE-2025-30156-6a9671af",
"target": {
"function": "aes_loop",
"file": "src/test/crypto.cc"
},
"deprecated": false,
"digest": {
"function_hash": "71465742050219093393176232472031099487",
"length": 925.0
},
"signature_version": "v1",
"source": "https://github.com/ceph/ceph/commit/3078188a7bdd89e2975280f2a906c71c2f6effd6",
"signature_type": "Function"
},
{
"id": "CVE-2025-30156-7e54339d",
"target": {
"function": "CryptoHandler::create",
"file": "src/auth/Crypto.cc"
},
"deprecated": false,
"digest": {
"function_hash": "34201271998738250695377263775433913870",
"length": 182.0
},
"signature_version": "v1",
"source": "https://github.com/ceph/ceph/commit/3078188a7bdd89e2975280f2a906c71c2f6effd6",
"signature_type": "Function"
},
{
"id": "CVE-2025-30156-90d4f842",
"target": {
"file": "src/test/crypto.cc"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"166986763539345896139198584354123892214",
"110387148403410578039540525197109176093",
"247309406486971668901405174802080358544",
"32971714808021081341414165411952377266",
"325488510661316807353978718898962302164",
"76364724405824790469323287381906425993",
"162155633687285106449390097276770368118",
"3302384902893117771305542848185252528",
"248619460779592843108330095022063319049",
"126464669828534033707824005680260068944",
"240673438649852719973082272379104857412",
"252185301257926677513583219555274235230",
"277668946633349217152842721184827841318",
"18785878891897176246863320647594440455",
"7900439960676535155855960252154866580",
"116214867838575682810479321547973296797",
"59626628646377666682571833138139935658",
"309324838474900254927827755941440680474",
"286305997623788813306112542157339471959",
"311073315630637522028164135388983746128",
"146787149186996199910174224329546026123",
"76364724405824790469323287381906425993",
"162155633687285106449390097276770368118",
"3302384902893117771305542848185252528",
"138256321031850222744882198461505025712",
"76759141834555516948490080375367233916",
"275497977719149732166247795690961925883",
"962302492270332000484368436692057866",
"273835763673760124610219828732350770903",
"110387148403410578039540525197109176093",
"247309406486971668901405174802080358544",
"124045186994594284468893018736091104438",
"281007900650270134479369618119718426175",
"218089816610177382352668113015324336141",
"200432852993846624554806691505687282964",
"8900858185979134324892067603989824705",
"276736643205633542686609665239266738809"
]
},
"signature_version": "v1",
"source": "https://github.com/ceph/ceph/commit/3078188a7bdd89e2975280f2a906c71c2f6effd6",
"signature_type": "Line"
},
{
"id": "CVE-2025-30156-91d33f8e",
"target": {
"file": "src/test/crypto.cc"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"166986763539345896139198584354123892214",
"110387148403410578039540525197109176093",
"247309406486971668901405174802080358544",
"32971714808021081341414165411952377266",
"325488510661316807353978718898962302164",
"76364724405824790469323287381906425993",
"162155633687285106449390097276770368118",
"3302384902893117771305542848185252528",
"248619460779592843108330095022063319049",
"126464669828534033707824005680260068944",
"240673438649852719973082272379104857412",
"252185301257926677513583219555274235230",
"277668946633349217152842721184827841318",
"18785878891897176246863320647594440455",
"7900439960676535155855960252154866580",
"116214867838575682810479321547973296797",
"59626628646377666682571833138139935658",
"309324838474900254927827755941440680474",
"286305997623788813306112542157339471959",
"311073315630637522028164135388983746128",
"146787149186996199910174224329546026123",
"76364724405824790469323287381906425993",
"162155633687285106449390097276770368118",
"3302384902893117771305542848185252528",
"138256321031850222744882198461505025712",
"76759141834555516948490080375367233916",
"275497977719149732166247795690961925883",
"962302492270332000484368436692057866",
"273835763673760124610219828732350770903",
"110387148403410578039540525197109176093",
"247309406486971668901405174802080358544",
"124045186994594284468893018736091104438",
"281007900650270134479369618119718426175",
"218089816610177382352668113015324336141",
"200432852993846624554806691505687282964",
"8900858185979134324892067603989824705",
"276736643205633542686609665239266738809"
]
},
"signature_version": "v1",
"source": "https://github.com/ceph/ceph/commit/2ba086255de09c8b95177717cc7e9dd4377e2f0f",
"signature_type": "Line"
},
{
"id": "CVE-2025-30156-92a9f803",
"target": {
"function": "CryptoHandler::create",
"file": "src/auth/Crypto.cc"
},
"deprecated": false,
"digest": {
"function_hash": "34201271998738250695377263775433913870",
"length": 182.0
},
"signature_version": "v1",
"source": "https://github.com/ceph/ceph/commit/2ba086255de09c8b95177717cc7e9dd4377e2f0f",
"signature_type": "Function"
},
{
"id": "CVE-2025-30156-a6e0973f",
"target": {
"function": "TEST",
"file": "src/test/crypto.cc"
},
"deprecated": false,
"digest": {
"function_hash": "96129151437415389453052484007555442942",
"length": 1146.0
},
"signature_version": "v1",
"source": "https://github.com/ceph/ceph/commit/2ba086255de09c8b95177717cc7e9dd4377e2f0f",
"signature_type": "Function"
},
{
"id": "CVE-2025-30156-a91e2562",
"target": {
"function": "CephContext::~CephContext",
"file": "src/common/ceph_context.cc"
},
"deprecated": false,
"digest": {
"function_hash": "281240549569918690276157070392254365268",
"length": 1002.0
},
"signature_version": "v1",
"source": "https://github.com/ceph/ceph/commit/3078188a7bdd89e2975280f2a906c71c2f6effd6",
"signature_type": "Function"
},
{
"id": "CVE-2025-30156-b3fd9e5f",
"target": {
"file": "src/auth/Crypto.cc"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"177065758090945851760449931674968841613",
"331694157586539836095392699590762109549",
"104045194296170142597570009514128019608",
"3972226125149754121327617198140429636",
"140473611810058361559931965535436877873",
"328475466762456077190779883530616043104",
"65109808503123295828418150447019093914",
"279834661296888747033828989242607763234",
"151105975094477800593598896244710238128",
"120280614403958812553613970619131026422",
"29237170902168267656570740813250942821",
"309903494677136292993624764576081364140",
"261938605169989597328512841121943244217",
"17017770065630453403899661629935446353",
"277248954865975091565161151554749029578",
"243451910281469811235287050556734824207",
"76401396019973569264525829383983105760"
]
},
"signature_version": "v1",
"source": "https://github.com/ceph/ceph/commit/3078188a7bdd89e2975280f2a906c71c2f6effd6",
"signature_type": "Line"
},
{
"id": "CVE-2025-30156-b56b5095",
"target": {
"function": "TEST",
"file": "src/test/crypto.cc"
},
"deprecated": false,
"digest": {
"function_hash": "209083237957749912669796795577432417267",
"length": 1146.0
},
"signature_version": "v1",
"source": "https://github.com/ceph/ceph/commit/3078188a7bdd89e2975280f2a906c71c2f6effd6",
"signature_type": "Function"
},
{
"id": "CVE-2025-30156-d1410e59",
"target": {
"function": "crush_location",
"file": "src/common/ceph_context.cc"
},
"deprecated": false,
"digest": {
"function_hash": "184966053259235643985708475743101066455",
"length": 3825.0
},
"signature_version": "v1",
"source": "https://github.com/ceph/ceph/commit/3078188a7bdd89e2975280f2a906c71c2f6effd6",
"signature_type": "Function"
},
{
"id": "CVE-2025-30156-d39b58c1",
"target": {
"function": "TEST",
"file": "src/test/crypto.cc"
},
"deprecated": false,
"digest": {
"function_hash": "107879702574115735810233433907646763595",
"length": 1383.0
},
"signature_version": "v1",
"source": "https://github.com/ceph/ceph/commit/3078188a7bdd89e2975280f2a906c71c2f6effd6",
"signature_type": "Function"
},
{
"id": "CVE-2025-30156-d43a2d2a",
"target": {
"file": "src/common/ceph_context.h"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"238083509200992647035337257821584571180",
"203634782045995963188738421552407186338",
"87135994561140433136218889491289898181",
"9186890098152610663510812762657628244"
]
},
"signature_version": "v1",
"source": "https://github.com/ceph/ceph/commit/2ba086255de09c8b95177717cc7e9dd4377e2f0f",
"signature_type": "Line"
},
{
"id": "CVE-2025-30156-e75556e1",
"target": {
"function": "TEST",
"file": "src/test/crypto.cc"
},
"deprecated": false,
"digest": {
"function_hash": "209083237957749912669796795577432417267",
"length": 1146.0
},
"signature_version": "v1",
"source": "https://github.com/ceph/ceph/commit/2ba086255de09c8b95177717cc7e9dd4377e2f0f",
"signature_type": "Function"
},
{
"id": "CVE-2025-30156-ebc4766d",
"target": {
"function": "CephContext::get_crypto_handler",
"file": "src/common/ceph_context.cc"
},
"deprecated": false,
"digest": {
"function_hash": "163578604243263679140065647037354139449",
"length": 196.0
},
"signature_version": "v1",
"source": "https://github.com/ceph/ceph/commit/3078188a7bdd89e2975280f2a906c71c2f6effd6",
"signature_type": "Function"
},
{
"id": "CVE-2025-30156-ee36b216",
"target": {
"function": "CephContext::~CephContext",
"file": "src/common/ceph_context.cc"
},
"deprecated": false,
"digest": {
"function_hash": "281240549569918690276157070392254365268",
"length": 1002.0
},
"signature_version": "v1",
"source": "https://github.com/ceph/ceph/commit/2ba086255de09c8b95177717cc7e9dd4377e2f0f",
"signature_type": "Function"
},
{
"id": "CVE-2025-30156-f509e2f0",
"target": {
"function": "TEST",
"file": "src/test/crypto.cc"
},
"deprecated": false,
"digest": {
"function_hash": "135467422423782816164285439193430693930",
"length": 1180.0
},
"signature_version": "v1",
"source": "https://github.com/ceph/ceph/commit/3078188a7bdd89e2975280f2a906c71c2f6effd6",
"signature_type": "Function"
},
{
"id": "CVE-2025-30156-fc7c173d",
"target": {
"function": "aes_loop_cephx",
"file": "src/test/crypto.cc"
},
"deprecated": false,
"digest": {
"function_hash": "114693090093363723641586779589274432617",
"length": 945.0
},
"signature_version": "v1",
"source": "https://github.com/ceph/ceph/commit/2ba086255de09c8b95177717cc7e9dd4377e2f0f",
"signature_type": "Function"
},
{
"id": "CVE-2025-30156-ff7ed954",
"target": {
"file": "src/common/ceph_context.cc"
},
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"41578653565868220279074809210998337438",
"93960078015615237875598891237883924386",
"158656258918753961787405445641267447210",
"77710679716358428638341804348728265765",
"185583858511315330129761845596152542171",
"235327743169536103610999597422691414918",
"18911565863761327200080632888548720781",
"188034010088706660436907698721945202424",
"185050653075051856001785083829664450638",
"40077328877534928062939153103586413270",
"66117929726710822380486926616002479016",
"215189374563737888949416880874566574628",
"145657690986678003689917577419569838328",
"244114983507801607400745851226527344676",
"1079364570786715084158330140198981237",
"316568526608998959928294922061184162313"
]
},
"signature_version": "v1",
"source": "https://github.com/ceph/ceph/commit/3078188a7bdd89e2975280f2a906c71c2f6effd6",
"signature_type": "Line"
}
]
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-30156.json"
vanir_signatures_modified
"2026-08-29T08:12:54Z"