CVE-2024-31884: Ceph: Incorct usage of certificate checking via Pybind

Published Aug 20, 2025

Updated

Ceph uses Pybind in a way which does not implement proper certificate checking. This impacts confidentiality and integrity, as an attacker may exploit an unset SSL context to allow the use of any certificate.

Affected Software

3 affected componentsFixes available

pypi/pybind

ceph Ceph

debian/ceph

16.2.15+ds-0+deb12u218.2.7+ds-1+deb13u120.2.4+ds-220.2.5+ds-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/ceph to a version that resolves this vulnerability.
Fixed in 16.2.15+ds-0+deb12u2Fixed in 18.2.7+ds-1+deb13u1Fixed in 20.2.4+ds-2Fixed in 20.2.5+ds-1

Event History

Aug 20, 2025

Data Sourced

via Red Hat·08:51 PM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

DSA-6321

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-4482-1

Frequently Asked Questions

What is the severity of CVE-2024-31884?

CVE-2024-31884 has a medium severity rating due to its potential impact on certificate verification processes.

How do I fix CVE-2024-31884?

To mitigate CVE-2024-31884, ensure that you update to the latest version of Ceph and Pybind where the certificate checking issue has been addressed.

What software is affected by CVE-2024-31884?

CVE-2024-31884 affects both Pybind and Ceph software components.

What are the potential risks associated with CVE-2024-31884?

The potential risks of CVE-2024-31884 include compromised security of communications due to improper certificate validation.

When was CVE-2024-31884 published?

CVE-2024-31884 was published on August 20, 2025.