CVE-2020-10763: 
Red Hat Enterprise Linux CoreOS (RHCOS) vulnerability analysis and mitigation

An information-disclosure flaw (CVE-2020-10763) was discovered in Heketi versions before 10.1.0. This vulnerability allows an attacker with local access to the Heketi server to read potentially sensitive information such as gluster-block passwords from log files (NVD, Debian Tracker).

The vulnerability is classified with a CVSS v3.1 Base Score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The issue is categorized under CWE-532 (Insertion of Sensitive Information into Log File). The flaw specifically involves the logging of sensitive gluster-block volume password details, a problem that has existed since the introduction of block volume support in heketi-v6.0.0 (NVD, Red Hat Bugzilla).

The vulnerability allows attackers with local access to the Heketi server to read sensitive information from log files, specifically gluster-block passwords. This could potentially lead to unauthorized access to protected resources if the exposed passwords are still valid (Red Hat Bugzilla).

The vulnerability requires local access to the Heketi server to exploit. There are no known reports of this vulnerability being exploited in the wild (NVD).

The vulnerability was fixed in Heketi version 10.1.0. Administrators are advised to upgrade to this version or later. For systems running older versions, it is recommended to check old logs for gluster-block passwords if block volumes were created with CHAP authentication enabled. Access to old logs containing passwords should be restricted or the logs should be removed (GitHub Release).

The vulnerability was discovered and reported by Prasanna Kumar Kalever of Red Hat. Red Hat has addressed this issue in their products through security advisory RHSA-2020:4143 (Red Hat Advisory).