PT-2017-13871 · Red Hat · Heketi

Publicado 2017-12-18 · Atualizado 2024-06-04 · CVE-2017-15103

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Heketi version 5

Description A security flaw was discovered in the Heketi server API, allowing an authenticated user to send specially crafted requests, potentially leading to remote command execution as the user running the Heketi server and possibly privilege escalation.

Recommendations For Heketi version 5, consider restricting access to the API until a fix is available, and avoid using the API for sensitive operations to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

RCE

Code Injection

Enumeração de Fraquezas

CWE-78

CWE-20

CWE-94

Identificadores relacionados

CVE-2017-15103

GHSA-6G56-V9QG-JP92

GO-2024-2763

RHSA-2017:3481

Produtos afetados

Heketi

Referências · 11

• https://github.com/heketi/heketi/commit/787bae461b23003a4daa4d1d639016a754cf6b00 · Nota
• https://github.com/heketi/heketi/releases/tag/v5.0.1 · Nota
• https://github.com/heketi/heketi · Nota
• https://osv.dev/vulnerability/CVE-2017-15103 · Aviso do Fabricante
• https://osv.dev/vulnerability/GO-2024-2763 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-6g56-v9qg-jp92 · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2017-15103 · Nota
• https://github.com/advisories/GHSA-6g56-v9qg-jp92 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-15103 · Nota de Segurança
• https://bugzilla.redhat.com/show_bug.cgi?id=1510147 · Correção
• https://access.redhat.com/errata/RHSA-2017:3481 · Aviso do Fabricante