The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4143 advisory.

    Red Hat OpenShift Container Storage(OCS) is a provider of agnostic persistent storage for OpenShift     Container Platform either in-house or in a hybrid cloud. As a Red Hat storage solution, OCS is completely     integrated with OpenShift Container Platform for deployment, management, and monitoring.

    Security Fix(es):

    * gluster-block: information disclosure through world-readable gluster-block log files (CVE-2020-10762)

    * heketi: gluster-block volume password details available in logs (CVE-2020-10763)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Earlier, the tcmu-runner did not give details about the file operations stuck at the backend glusterfs     block hosting volume. With this change, the tcmu-runner is now able to log details about the file     operations stuck at the backend glusterfs block hosting volume and this will help identify the root cause     of the input/output errors easily. (BZ#1850361)

    * Earlier, there was no log rotation with gluster-block logs. With this release, log rotation is possible     for gluster-block and tcmu-runner relevant logs. (BZ#1850365)

    * Earlier, heketi did not track all the changes made to volumes as part of device remove operation. With     this release, heketis device remove operation is fully tracked and is based on a series of brick evict     operations making the operation more reliable. (BZ#1850072)

    * An access flaw CVE-2020-13867 was found in targetcli due to which the files under /etc/target and     '/etc/target/backup' directory were widely accessible. With this release, the access flaw is fixed as a     workaround in gluster-block to protect these files from any potential attacks for accessing sensitive     information, until the flaw is resolved and made available in targetcli.(BZ#1850077)

    All Red Hat OpenShift Container Storage users are advised to upgrade to these updated packages.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

リモートの Redhat Enterprise Linux 7 ホストにインストールされているパッケージは、RHSA-2020: 4143 のアドバイザリに記載されている複数の脆弱性の影響を受けます。

  - gluster-block: 全ユーザーに読み取り権限がある gluster-block ファイルによる情報開示 (CVE-2020-10762)

  - heketi: gluster ブロックボリュームパスワードの詳細がログで利用可能 (CVE-2020-10763)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションの自己報告されたバージョン番号にのみ依存しています。

远程 Redhat Enterprise Linux 7 主机上安装的程序包受到 RHSA-2020: 4143 公告中提及的漏洞的影响。

  - gluster-block：通过全局可读的 gluster-block 日志文件造成的信息泄露 (CVE-2020-10762)

  - heketi: 日志中提供 gluster-block 卷密码详细信息 (CVE-2020-10763)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

遠端 Redhat Enterprise Linux 7 主機上安裝的套件受到 RHSA-2020: 4143 公告中提及的多個弱點影響。

  - gluster-block：透過任何人皆可讀取的 gluster-block 記錄檔案造成資訊洩漏 (CVE-2020-10762)

  - heketi：記錄中提供 gluster-block 磁碟區密碼詳細資料 (CVE-2020-10763)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

ID	名稱	產品	系列	已發布	已更新	嚴重性
170347	RHEL 7 : OCS 3.11.z async (RHSA-2020:4143)	Nessus	Red Hat Local Security Checks	2023/1/23	2024/6/4	medium
170347	RHEL 7: OCS 3.11.z async (RHSA-2020: 4143)	Nessus	Red Hat Local Security Checks	2023/1/23	2024/6/4	medium
170347	RHEL 7：OCS 3.11.z 异步 (RHSA-2020：4143)	Nessus	Red Hat Local Security Checks	2023/1/23	2024/6/4	medium
170347	RHEL 7：OCS 3.11.z async (RHSA-2020: 4143)	Nessus	Red Hat Local Security Checks	2023/1/23	2024/6/4	medium

偵測

搜尋 Plugin

medium

medium

medium

medium