PT-2017-13871 · Red Hat · Heketi

Published 2017-12-18 · Updated 2024-06-04 · CVE-2017-15103

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Heketi version 5

Description A security flaw was discovered in the Heketi server API, allowing an authenticated user to send specially crafted requests, potentially leading to remote command execution as the user running the Heketi server and possibly privilege escalation.

Recommendations For Heketi version 5, consider restricting access to the API until a fix is available, and avoid using the API for sensitive operations to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

RCE

Code Injection

Weakness Enumeration

CWE-78

CWE-20

CWE-94

Related Identifiers

CVE-2017-15103

GHSA-6G56-V9QG-JP92

GO-2024-2763

RHSA-2017:3481

Affected Products

Heketi

References · 11

• https://osv.dev/vulnerability/CVE-2017-15103 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2763 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6g56-v9qg-jp92 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-15103 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1510147 · Patch
• https://access.redhat.com/errata/RHSA-2017:3481 · Vendor Advisory
• https://github.com/heketi/heketi/commit/787bae461b23003a4daa4d1d639016a754cf6b00 · Note
• https://github.com/heketi/heketi/releases/tag/v5.0.1 · Note
• https://github.com/heketi/heketi · Note
• https://access.redhat.com/security/cve/CVE-2017-15103 · Note
• https://github.com/advisories/GHSA-6g56-v9qg-jp92 · Note