CVE-2017-15103: Heketi Arbitrary Code Execution in github.com/heketi/heketi
Summary
CVE-2017-15103: Heketi Arbitrary Code Execution in github.com/heketi/heketi. Affects github.com/heketi/heketi versions < 5.0.1+incompatible. Fixed in 5.0.1+incompatible. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is github.com/heketi/heketi, which is written in Go. Heketi is a volume management framework for GlusterFS, a distributed file system. It provides a RESTful interface to manage storage resources in a GlusterFS cluster. The vulnerability in this package allows for arbitrary code execution.
Vulnerability Detail
The vulnerability in github.com/heketi/heketi, identified as CVE-2017-15103, enables an attacker to execute arbitrary code. This can lead to various security issues, such as unauthorized access, data breaches, and system compromise. The vulnerability originates from a flaw in the code that allows untrusted input to be executed as code.
How To Fix
Latest published version: v10.3.0+incompatible as of 23 Oct 2026
go get github.com/heketi/heketi@v10.3.0+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.0.1+incompatible
This is the first release that contains the fix.
go get github.com/heketi/heketi@v5.0.1+incompatibleTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the package to the fixed version to address the issue.
Conclusion
In conclusion, the vulnerability in github.com/heketi/heketi allows for arbitrary code execution, which can have severe security implications. It is crucial to update the package to version 5.0.1 or later to address this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/heketi/heketi →
FAQ
This vulnerability allows an attacker to execute arbitrary code, which can lead to unauthorized access, data breaches, and system compromise.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your Gopkg.lock file and the tool will provide real-time alerts for open-source vulnerabilities.
There may be known exploits for this vulnerability, as it has been publicly disclosed. It is crucial to update the package to the fixed version to protect against potential attacks.
Yes, a patch is available for this vulnerability. It is recommended to update the package to version 5.0.1 or later to apply the necessary fixes.
No, updating the package to the fixed version is the only way to mitigate the risk associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/heketi/heketi.
