CVE-2017-15103: OS Command Injection
A flaw was found in heketi API that permits issuing of OS commands through especially crafted requests, possibly leading to escalation of privileges.
https://github.com/heketi/heketi/releases/tag/v5.0.1 https://github.com/heketi/heketi/commit/787bae461b23003a4daa4d1d639016a754cf6b00
https://access.redhat.com/security/vulnerabilities/3246991
Other sources
A security-check flaw was found in the way the Heketi 5 server API handled user requests. An authenticated Heketi user could send specially crafted requests to the Heketi server, resulting in remote command execution as the user running Heketi server and possibly privilege escalation.
— GitHub
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2017-15103?
CVE-2017-15103 is a security-check flaw in the Heketi 5 server API that allows for remote command execution and possible privilege escalation.
How does CVE-2017-15103 affect Heketi?
CVE-2017-15103 affects Heketi version 5.0, allowing an authenticated user to send specially crafted requests to the server.
What is the severity of CVE-2017-15103?
CVE-2017-15103 has a severity rating of 8.8 (Critical).
What is the Common Weakness Enumeration (CWE) for CVE-2017-15103?
The CWEs associated with CVE-2017-15103 are CWE-78 (Improper Neutralization of Special Elements used in an OS Command) and CWE-20 (Improper Input Validation).
How can I fix CVE-2017-15103?
To fix CVE-2017-15103, you should apply the patches and updates provided by the Heketi Project or Redhat Enterprise Linux, depending on your software version.