CVE-2017-15104: Information Exposure in Heketi
Summary
CVE-2017-15104: Information Exposure in Heketi. Affects github.com/heketi/heketi versions < 5.0.1. Fixed in 5.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Heketi is a Go package that provides a RESTful management interface to manage the lifecycle of GlusterFS volumes. It allows users to dynamically provision GlusterFS volumes in a Kubernetes environment. Heketi uses a configuration file called heketi.json to store various settings, including passwords. However, in Heketi version 5.0.0, the heketi.json file was world-readable, which means any local user with access to the Heketi server could read the plain-text passwords from the file.
Vulnerability Detail
The vulnerability (CVE-2017-15104) in Heketi version 5.0.0 allowed unauthorized access to sensitive information. An attacker with local access to the Heketi server could read the plain-text passwords stored in the heketi.json configuration file. This could lead to unauthorized access to the GlusterFS volumes managed by Heketi and potential compromise of the entire storage infrastructure. The vulnerability was assigned a CVSS score of 7.8, indicating a high severity.
How To Fix
Latest published version: v10.3.0+incompatible as of 23 Oct 2026
go get github.com/heketi/heketi@v10.3.0+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.0.1
This is the first release that contains the fix.
go get github.com/heketi/heketi@v5.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a temporary workaround is to manually change the permissions of the heketi.json file to restrict access. The file should only be readable by the necessary system users and should not be accessible to unauthorized users. Here is an example command to set the correct permissions:
chmod 600 /path/to/heketi.json
Conclusion
The vulnerability in Heketi version 5.0.0 allowed unauthorized access to plain-text passwords stored in the heketi.json configuration file. Upgrading to version 5.0.1 or later is recommended to fix this issue. If immediate upgrade is not possible, manually changing the permissions of the heketi.json file can provide a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/heketi/heketi →
FAQ
Heketi is a Go package that provides a RESTful management interface to manage the lifecycle of GlusterFS volumes in a Kubernetes environment.
The vulnerability allows unauthorized users with local access to the Heketi server to read plain-text passwords from the heketi.json configuration file. This could lead to unauthorized access to GlusterFS volumes and potential compromise of the storage infrastructure.
To fix this vulnerability, it is recommended to upgrade to Heketi version 5.0.1 or later. This version addresses the issue of the world-readable heketi.json file and ensures proper protection of plain-text passwords.
Yes, if immediate upgrade is not possible, you can manually change the permissions of the heketi.json file to restrict access. Set the file permissions to 600 to ensure it is only readable by necessary system users.
The CVSS score of this vulnerability is 7.8, indicating a high severity.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/heketi/heketi.
