Sensitive information in log files in heketi
Priority LOW 25CWE-532Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 3 fixed, 1 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-532.
Summary
An information-disclosure flaw was found in the way Heketi before 10.1.0 logs sensitive information. This flaw allows an attacker with local access to the Heketi server to read potentially sensitive information such as gluster-block passwords.
Why it matters now
EPSS 0.00419 36th percentileScored 2026-11-07
Fix Partial github.com/heketi/heketi (Go): 10.1.0Red Hat: 1 advisoryRed Hat: 3 fixed, 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | heketi | heketi 10.1.0 | — | No fix listed | CNA |
| — | github.com/heketi/heketi (Go) | before 10.1.0 | 10.1.0 | Patch available | GHSA-rm7c-x6gj-2mr8 |
- heketi Vendor— Affected heketi 10.1.0 Fixed in — No fix listed CNA
- github.com/heketi/heketi (Go) Vendor— Affected before 10.1.0 Fixed in 10.1.0 Patch available GHSA-rm7c-x6gj-2mr8
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:heketi_project:heketi:*:*:*:*:*:*:*:* | before 10.1.0 | Vulnerable | The Heketi Project |
| cpe:2.3:a:redhat:gluster_storage:3.0:*:*:*:*:*:*:* | 3.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:gluster_storage:3.5:*:*:*:*:*:*:* | 3.5 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:* | 4.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
- cpe:2.3:a:heketi_project:heketi:*:*:*:*:*:*:*:* Versions before 10.1.0 Vulnerable ·The Heketi Project
- cpe:2.3:a:redhat:gluster_storage:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:gluster_storage:3.5:*:*:*:*:*:*:* Versions 3.5 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
Remediation
- Fix · GHSA-rm7c-x6gj-2mr8 github.com/heketi/heketi (Go) Fixed in 10.1.0 Advisory →
Red Hat 1 advisory
- RHSA-2020:4143 Released 2020-09-30 · Red Hat rating ModerateOCS 3.11.z async security, bug fix, and enhancement update
- Red Hat Gluster Storage Server 3.5 on RHEL-7 gluster-block-0.2.1-36.2.el7rhgs, heketi-9.0.0-9.5.el7rhgs, heketi-client-9.0.0-9.5.el7rhgs +4
- Red Hat Storage Native Client for Red Hat Enterprise Linux 7 heketi-9.0.0-9.5.el7rhgs, heketi-client-9.0.0-9.5.el7rhgs
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Container Platform 4 | Affected | No fix planned: Will not fix |
| Red Hat Gluster Storage Server 3.5 on RHEL-7 | Fixed | RHSA-2020:4143 |
| Red Hat OpenShift Container Platform 4.7 | Fixed | RHSA-2020:5633 |
| Red Hat Storage Native Client for Red Hat Enterprise Linux 7 | Fixed | RHSA-2020:4143 |
Not affected: 3 products
- Red Hat OpenShift Container Platform 3.11
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.7
Timeline
- 2026-10-02 Threatist record created from CVE-2020-10763
- 2026-10-03 Alias added: GHSA-rm7c-x6gj-2mr8
References
Sources
- CVE-2020-10763 · CVE Program
- CVE-2020-10763 · NVD
- FIRST EPSS
- GHSA-rm7c-x6gj-2mr8 · GitHub Advisory Database · CC BY 4.0
- CVE-2020-10763 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences