Description
An access flaw was found in Heketi 5, where the heketi.json configuration file was world readable. An attacker having local access to the Heketi server could read plain-text passwords from the heketi.json file.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Heketi | Heketi | 5.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Gluster Storage 3 | heketi +2 | 5.0.0-19.el7rhgs | RHSA-2017:3481 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/heketi/heketi | < 5.0.1 | 5.0.1 | GHSA-q9vw-wr57-xjv3 |
| Go | github.com/heketi/heketi | < 5.0.1+incompatible | 5.0.1+incompatible | GO-2022-0866 |
Advisories 1
- RHSA-2017:3481 Red Hat Security Advisory: heketi security update Red Hat Security Advisories (RHSA) · May 13, 2026