Description
An information-disclosure flaw was found in the way Heketi before 10.1.0 logs sensitive information. This flaw allows an attacker with local access to the Heketi server to read potentially sensitive information such as gluster-block passwords.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | heketi | heketi 10.1.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Gluster Storage 3 | gluster-block | 0.2.1-36.2.el7rhgs | RHSA-2020:4143 |
| Red Hat Gluster Storage 3 | heketi +2 | 9.0.0-9.5.el7rhgs | RHSA-2020:4143 |
| Red Hat Gluster Storage 3 | libtcmu +2 | 1.2.0-32.2.el7rhgs | RHSA-2020:4143 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/heketi/heketi | < 10.1.0 | 10.1.0 | GHSA-rm7c-x6gj-2mr8 |
Advisories 1
- RHSA-2020:4143 Red Hat Security Advisory: OCS 3.11.z async security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 27, 2026