high7.8
CVE-2017-15104
Information Exposure in Heketi
Impact
An access flaw was found in Heketi 5, where the heketi.json configuration file was world readable. An attacker having local access to the Heketi server could read plain-text passwords from the heketi.json file.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/heketi/heketi | < 5.0.1 | 5.0.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Heketi Project | Heketi | Version 5.0.0 |
| Redhat | Enterprise Linux | Version 7.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://access.redhat.com/errata/RHSA-2017:3481
- https://access.redhat.com/security/cve/CVE-2017-15104
- https://bugzilla.redhat.com/show_bug.cgi?id=1510149
- https://github.com/heketi/heketi/releases/tag/v5.0.1
- https://github.com/advisories/GHSA-q9vw-wr57-xjv3
- https://nvd.nist.gov/vuln/detail/CVE-2017-15104
- https://github.com/heketi/heketi/commit/787bae461b23003a4daa4d1d639016a754cf6b00