Bug 1845067 (CVE-2020-10762)
| Summary: | CVE-2020-10762 gluster-block: information disclosure through world-readable gluster-block log files | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Hardik Vyas <hvyas> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | hvyas, prasanna.kalever, puebele, rhs-bugs, sabose, sajmoham, security-response-team, xiubli |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | gluster-block 0.5.1 | Doc Type: | If docs needed, set a value |
| Doc Text: |
An information-disclosure flaw was found in the way that gluster-block logs the output from gluster-block CLI operations. This includes recording passwords to the cmd_history.log file which is world-readable. This flaw allows local users to obtain sensitive information by reading the log file. The highest threat from this vulnerability is to data confidentiality.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-09-30 20:21:09 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1845071, 1877221 | ||
| Bug Blocks: | 1844560 | ||
|
Description
Hardik Vyas
2020-06-08 12:02:11 UTC
Acknowledgments: Name: Prasanna Kumar Kalever (Red Hat) Mitigation: Manually change the log files permission to remove readable bits for others, e.g; # chmod 640 /var/log/glusterfs/gluster-block/cmd_history.log NOTE: The above mitigation only restricts access to the other local users. To avoid storing passwords to the log file, kindly update gluster-block to the fixed version. Statement: The version of gluster-block shipped with Red Hat Gluster Storage 3 sets the world-readable permissions on gluster-block directory and log files that store the sensitive information, hence affected by this vulnerability. Upstream PR: https://github.com/gluster/gluster-block/pull/280 External References: https://github.com/gluster/gluster-block/releases/tag/v0.5.1 This issue has been addressed in the following products: Red Hat Gluster Storage 3.5 for RHEL 7 Native Client for RHEL 7 for Red Hat Storage Via RHSA-2020:4143 https://access.redhat.com/errata/RHSA-2020:4143 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-10762 |