CVE-2017-15104

Se ha detectado una vulnerabilidad de acceso en Heketi 5, donde el archivo de configuración heketi.json puede ser leído por cualquier usuario. Un atacante que tenga acceso local al servidor Heketi podría leer contraseñas en texto plano del archivo heketi.json.

An access flaw was found in heketi, where the heketi.json configuration file was world readable. An attacker having local access to the Heketi server could read plain-text passwords from the heketi.json file.

Heketi provides a RESTful management interface which can be used to manage the life cycle of GlusterFS volumes. With Heketi, cloud services like OpenStack Manila, Kubernetes, and OpenShift can dynamically provision GlusterFS volumes with any of the supported durability types. Heketi will automatically determine the location for bricks across the cluster, making sure to place bricks and its replicas across different failure domains. Heketi also supports any number of GlusterFS clusters, allowing cloud services to provide network file storage without being limited to a single GlusterFS cluster. Multiple security issues have been addressed.