Skip to content
OpenAdvisories
High RHSA-2017:3481 2 CVEs

Red Hat Security Advisory: heketi security update

Published Sep 16, 2024 · Updated May 13, 2026

Ecosystem: Red Hat

Fixed packages 3

ReleasePackageFixed in
Red Hat · Gluster Storage 3 storage:3.3:server:el7 heketi 0:5.0.0-19.el7rhgs
Red Hat · Gluster Storage 3 storage:3.3:server:el7 heketi-client 0:5.0.0-19.el7rhgs
Red Hat · Gluster Storage 3 storage:3.3:server:el7 python-heketi 0:5.0.0-19.el7rhgs

Vulnerabilities 2

  • High 8.8
    CVE-2017-15103

    Heketi Arbitrary Code Execution

    A security-check flaw was found in the way the Heketi 5 server API handled user requests. An authenticated Heketi user could send specially crafted requests to the Heketi server, resulting in remote command execution as the user running Heketi server and poss…

    Heketi Heketi github.com/heketi/heketi Go
  • High 7.8
    CVE-2017-15104

    Information Exposure in Heketi

    An access flaw was found in Heketi 5, where the heketi.json configuration file was world readable. An attacker having local access to the Heketi server could read plain-text passwords from the heketi.json file.

    Heketi Heketi github.com/heketi/heketi Go

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1510147
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1510149
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_3481.json
  • report
    https://access.redhat.com/security/cve/CVE-2017-15103
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-15103
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-15103
  • report
    https://access.redhat.com/security/cve/CVE-2017-15104
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-15104
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-15104