Description
An information-disclosure flaw was found in the way that gluster-block before 0.5.1 logs the output from gluster-block CLI operations. This includes recording passwords to the cmd_history.log file which is world-readable. This flaw allows local users to obtain sensitive information by reading the log file. The highest threat from this vulnerability is to data confidentiality.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | gluster-block | gluster-block 0.5.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Gluster Storage 3 | gluster-block | 0.2.1-36.2.el7rhgs | RHSA-2020:4143 |
| Red Hat Gluster Storage 3 | heketi +2 | 9.0.0-9.5.el7rhgs | RHSA-2020:4143 |
| Red Hat Gluster Storage 3 | libtcmu +2 | 1.2.0-32.2.el7rhgs | RHSA-2020:4143 |
Advisories 1
- RHSA-2020:4143 Red Hat Security Advisory: OCS 3.11.z async security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 27, 2026