Red Hat Security Advisory: heketi security, bug fix, and enhancement update
Updated heketi packages that fix one security issue, multiple bugs, and adds various enhancements is now available for OpenShift Container Storage 3.11 Batch 4 Update. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2019-3899US | critical9.8OT elevated | — | ||
It was found that default configuration of Heketi does not require any authentication potentially exposing the management interface to misuse. This isue only affects heketi as ship… | ||||
references
External citations — patches, advisories, analysis.
- https://access.redhat.com/errata/RHSA-2019:3255self
- https://access.redhat.com/security/updates/classification/#moderateexternal
- 1577803external
- 1609553external
- 1636912external
- 1660681external
- 1701091external
- 1702162external
remediations (12)
- Fixedheketi-0:9.0.0-7.el7rhgs.src as a component of Red Hat Gluster Storage Server 3.5 on RHEL-7
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:3255 - Fixedheketi-0:9.0.0-7.el7rhgs.src as a component of Red Hat Storage Native Client for Red Hat Enterprise Linux 7
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:3255 - Fixedheketi-0:9.0.0-7.el7rhgs.x86_64 as a component of Red Hat Gluster Storage Server 3.5 on RHEL-7
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:3255 - Fixedheketi-client-0:9.0.0-7.el7rhgs.x86_64 as a component of Red Hat Gluster Storage Server 3.5 on RHEL-7
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:3255 - Fixedheketi-client-0:9.0.0-7.el7rhgs.x86_64 as a component of Red Hat Storage Native Client for Red Hat Enterprise Linux 7
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:3255 - Fixedpython-heketi-0:9.0.0-7.el7rhgs.x86_64 as a component of Red Hat Gluster Storage Server 3.5 on RHEL-7
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2019:3255 - Workaroundheketi-0:9.0.0-7.el7rhgs.src as a component of Red Hat Gluster Storage Server 3.5 on RHEL-7
After installation of Heketi 1. configure user and admin key in /etc/heketi/heketi.json file ... { "_port_comment": "Heketi Server Port Number", "port": "8080", "_use_auth": "Enable JWT authorization. Please enable for deployment", "use_auth": true, "_jwt": "Private keys for access", "jwt": { "_admin": "Admin has access to all APIs", "admin": { "key": "My Secret" }, "_user": "User only has access to /volumes endpoint", "user": { "key": "My Secret" } }, ... 2. restart heketi server
- Workaroundheketi-0:9.0.0-7.el7rhgs.src as a component of Red Hat Storage Native Client for Red Hat Enterprise Linux 7
After installation of Heketi 1. configure user and admin key in /etc/heketi/heketi.json file ... { "_port_comment": "Heketi Server Port Number", "port": "8080", "_use_auth": "Enable JWT authorization. Please enable for deployment", "use_auth": true, "_jwt": "Private keys for access", "jwt": { "_admin": "Admin has access to all APIs", "admin": { "key": "My Secret" }, "_user": "User only has access to /volumes endpoint", "user": { "key": "My Secret" } }, ... 2. restart heketi server
- Workaroundheketi-0:9.0.0-7.el7rhgs.x86_64 as a component of Red Hat Gluster Storage Server 3.5 on RHEL-7
After installation of Heketi 1. configure user and admin key in /etc/heketi/heketi.json file ... { "_port_comment": "Heketi Server Port Number", "port": "8080", "_use_auth": "Enable JWT authorization. Please enable for deployment", "use_auth": true, "_jwt": "Private keys for access", "jwt": { "_admin": "Admin has access to all APIs", "admin": { "key": "My Secret" }, "_user": "User only has access to /volumes endpoint", "user": { "key": "My Secret" } }, ... 2. restart heketi server
- Workaroundheketi-client-0:9.0.0-7.el7rhgs.x86_64 as a component of Red Hat Gluster Storage Server 3.5 on RHEL-7
After installation of Heketi 1. configure user and admin key in /etc/heketi/heketi.json file ... { "_port_comment": "Heketi Server Port Number", "port": "8080", "_use_auth": "Enable JWT authorization. Please enable for deployment", "use_auth": true, "_jwt": "Private keys for access", "jwt": { "_admin": "Admin has access to all APIs", "admin": { "key": "My Secret" }, "_user": "User only has access to /volumes endpoint", "user": { "key": "My Secret" } }, ... 2. restart heketi server
- Workaroundheketi-client-0:9.0.0-7.el7rhgs.x86_64 as a component of Red Hat Storage Native Client for Red Hat Enterprise Linux 7
After installation of Heketi 1. configure user and admin key in /etc/heketi/heketi.json file ... { "_port_comment": "Heketi Server Port Number", "port": "8080", "_use_auth": "Enable JWT authorization. Please enable for deployment", "use_auth": true, "_jwt": "Private keys for access", "jwt": { "_admin": "Admin has access to all APIs", "admin": { "key": "My Secret" }, "_user": "User only has access to /volumes endpoint", "user": { "key": "My Secret" } }, ... 2. restart heketi server
- Workaroundpython-heketi-0:9.0.0-7.el7rhgs.x86_64 as a component of Red Hat Gluster Storage Server 3.5 on RHEL-7
After installation of Heketi 1. configure user and admin key in /etc/heketi/heketi.json file ... { "_port_comment": "Heketi Server Port Number", "port": "8080", "_use_auth": "Enable JWT authorization. Please enable for deployment", "use_auth": true, "_jwt": "Private keys for access", "jwt": { "_admin": "Admin has access to all APIs", "admin": { "key": "My Secret" }, "_user": "User only has access to /volumes endpoint", "user": { "key": "My Secret" } }, ... 2. restart heketi server
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan