Description
Tendrl API in Red Hat Gluster Storage before 3.4.0 does not immediately remove session tokens after a user logs out. Session tokens remain active for a few minutes allowing attackers to replay tokens acquired via sniffing/MITM attacks and authenticate as the target user.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Gluster Storage | 3.4.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Gluster Storage 3 | python-flask +1 | 1:0.10.1-5.el7rhgs | RHSA-2018:2616 |
| Red Hat Gluster Storage 3 | python-itsdangerous | 0.23-2.el7 | RHSA-2018:2616 |
| Red Hat Gluster Storage 3 | tendrl-ansible | 1.6.3-7.el7rhgs | RHSA-2018:2616 |
| Red Hat Gluster Storage 3 | tendrl-api +1 | 1.6.3-5.el7rhgs | RHSA-2018:2616 |
| Red Hat Gluster Storage 3 | tendrl-commons | 1.6.3-12.el7rhgs | RHSA-2018:2616 |
| Red Hat Gluster Storage 3 | tendrl-node-agent +1 | 1.6.3-10.el7rhgs | RHSA-2018:2616 |
| Red Hat Gluster Storage 3 | tendrl-notifier | 1.6.3-4.el7rhgs | RHSA-2018:2616 |
| Red Hat Gluster Storage 3 | tendrl-ui +2 | 1.6.3-11.el7rhgs | RHSA-2018:2616 |
Advisories 1
- RHSA-2018:2616 Red Hat Security Advisory: RHGS WA security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jul 1, 2026
References
- RHSA-2018:2616 vendor-advisory
- 1041597 vdb-entry
- https://github.com/Tendrl/api/pull/422
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1127