CVE-2020-10763: Medium severity Heketi Project Heketi vulnerability
An information-disclosure flaw was found in the way Heketi before 10.1.0 logs sensitive information. This flaw allows an attacker with local access to the Heketi server to read potentially sensitive information such as gluster-block passwords.
Other sources
An information-disclosure flaw was found in the way Heketi logs sensitive information. This flaw allows an attacker with local access to the Heketi server, to read potentially sensitive information, such as gluster-block passwords.
While requesting a new block volume creation, at Heketi we dump the sensitive gluster-block volumes PASSWORD details in the logs. This is a very old bug, starting from the introduction of block volume support to heketi-v6.0.0.
— Red Hat
Affected Software
Remediation
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-10763?
CVE-2020-10763 is an information-disclosure vulnerability found in Heketi before 10.1.0 that allows an attacker with local access to the Heketi server to read potentially sensitive information.
How does CVE-2020-10763 impact Heketi?
CVE-2020-10763 impacts Heketi by allowing an attacker with local access to the server to read sensitive information, such as gluster-block passwords.
What is the severity of CVE-2020-10763?
CVE-2020-10763 has a severity rating of medium with a CVSS score of 5.5.
How can I fix CVE-2020-10763?
To fix CVE-2020-10763, update Heketi to version 10.1.0 or later.
Where can I find more information about CVE-2020-10763?
You can find more information about CVE-2020-10763 on the official CVE website, NIST NVD, and the GitHub page for Heketi.