An information-disclosure flaw was found in the way Heketi before 10.1.0 logs sensitive information. This flaw allows an attacker with local access to the Heketi server to read potentially sensitive information such as gluster-block passwords.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An information-disclosure flaw was found in the way Heketi before 10.1.0 logs sensitive information. This
    flaw allows an attacker with local access to the Heketi server to read potentially sensitive information
    such as gluster-block passwords. (CVE-2020-10763)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4143 advisory.

    Red Hat OpenShift Container Storage(OCS) is a provider of agnostic persistent storage for OpenShift     Container Platform either in-house or in a hybrid cloud. As a Red Hat storage solution, OCS is completely     integrated with OpenShift Container Platform for deployment, management, and monitoring.

    Security Fix(es):

    * gluster-block: information disclosure through world-readable gluster-block log files (CVE-2020-10762)

    * heketi: gluster-block volume password details available in logs (CVE-2020-10763)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Earlier, the tcmu-runner did not give details about the file operations stuck at the backend glusterfs     block hosting volume. With this change, the tcmu-runner is now able to log details about the file     operations stuck at the backend glusterfs block hosting volume and this will help identify the root cause     of the input/output errors easily. (BZ#1850361)

    * Earlier, there was no log rotation with gluster-block logs. With this release, log rotation is possible     for gluster-block and tcmu-runner relevant logs. (BZ#1850365)

    * Earlier, heketi did not track all the changes made to volumes as part of device remove operation. With     this release, heketis device remove operation is fully tracked and is based on a series of brick evict     operations making the operation more reliable. (BZ#1850072)

    * An access flaw CVE-2020-13867 was found in targetcli due to which the files under /etc/target and     '/etc/target/backup' directory were widely accessible. With this release, the access flaw is fixed as a     workaround in gluster-block to protect these files from any potential attacks for accessing sensitive     information, until the flaw is resolved and made available in targetcli.(BZ#1850077)

    All Red Hat OpenShift Container Storage users are advised to upgrade to these updated packages.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
434344	SCA: security update for github.com/heketi/heketi (GHSA-rm7c-x6gj-2mr8)	Tenable Cloud Security	SCA Checks	medium
434344	SCA: security update for github.com/heketi/heketi (GHSA-rm7c-x6gj-2mr8)	Tenable Self-Hosted Container Security	SCA Checks	medium
170347	RHEL 7 : OCS 3.11.z async (RHSA-2020:4143)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2020-10763

medium

Tenable Plugins

medium

medium

medium