CVE-2020-10763
Fixed in a distro release EPSS <1%
An information-disclosure flaw was found in the way Heketi before 10.1.0 logs sensitive information. This flaw allows an attacker with local access to the Heketi server to read potentially sensitive information such as gluster-block passwords.
Products: heketi_project heketi, redhat gluster_storage, redhat openshift_container_platform, redhat enterprise_linux
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/heketi/heketi | 10.1.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat storage 3.5 server el7 | gluster-block | 0:0.2.1-36.2.el7rhgs |
| Red Hat storage 3.5 server el7 | gluster-block-debuginfo | 0:0.2.1-36.2.el7rhgs |
| Red Hat storage 3.5 server el7 | heketi | 0:9.0.0-9.5.el7rhgs |
| Red Hat storage 3.5 server el7 | heketi-client | 0:9.0.0-9.5.el7rhgs |
| Red Hat storage 3.5 server el7 | libtcmu | 0:1.2.0-32.2.el7rhgs |
| Red Hat storage 3.5 server el7 | libtcmu-devel | 0:1.2.0-32.2.el7rhgs |
| Red Hat storage 3.5 server el7 | python-heketi | 0:9.0.0-9.5.el7rhgs |
| Red Hat storage 3.5 server el7 | tcmu-runner | 0:1.2.0-32.2.el7rhgs |
| Red Hat storage 3.5 server el7 | tcmu-runner-debuginfo | 0:1.2.0-32.2.el7rhgs |
| Red Hat storage 3 client el7 | heketi | 0:9.0.0-9.5.el7rhgs |
| Red Hat storage 3 client el7 | heketi-client | 0:9.0.0-9.5.el7rhgs |