Tendrl API in Red Hat Gluster Storage does not immediately remove session tokens after a user logs out. Session tokens remain active for a few minutes allowing attackers to replay tokens acquired via sniffing/MITM attacks and authenticate as the target user. Upstream patch: https://github.com/Tendrl/api/pull/422
Acknowledgments: Name: Filip Balák (Red Hat)
This issue has been addressed in the following products: Red Hat Gluster Storage 3.4 for RHEL 7 Via RHSA-2018:2616 https://access.redhat.com/errata/RHSA-2018:2616