Important: Red Hat Security Advisory: web-admin-build security and bug fix update

Updated web-admin-build packages that fixes one bug are now available for Red Hat Gluster Storage 3.5 on Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detail...

Replay Attack

tendrl-api is vulnerable to replay attack. The server does not invalidate session tokens immediately when a user logs out of the application. This allows an attacker, who has obtained a user's session tokens via sniffing/MitM attack, to re-use or replay a user's session token or request to gain...

Session fixation

Tendrl API in Red Hat Gluster Storage before 3.4.0 does not immediately remove session tokens after a user logs out. Session tokens remain active for a few minutes allowing attackers to replay tokens acquired via sniffing/MITM attacks and authenticate as the target user...

CVE-2018-1127

Tendrl API in Red Hat Gluster Storage before 3.4.0 does not immediately remove session tokens after a user logs out. Session tokens remain active for a few minutes allowing attackers to replay tokens acquired via sniffing/MITM attacks and authenticate as the target user...

CVE-2018-1127

Tendrl API in Red Hat Gluster Storage before 3.4.0 does not immediately remove session tokens after a user logs out. Session tokens remain active for a few minutes allowing attackers to replay tokens acquired via sniffing/MITM attacks and authenticate as the target user...

CVE-2018-1127

CVE-2018-1127 affects Tendrl API in Red Hat Gluster Storage prior to 3.4.0, where session tokens are not immediately invalidated on logout and remain usable for a short window. This allows an attacker who captured tokens (e.g., via sniffing/MITM) to replay them and authenticate as the target user...

tendrl-api: Improper cleanup of session token can allow attackers to hijack user sessions

Tendrl API in Red Hat Gluster Storage before 3.4.0 does not immediately remove session tokens after a user logs out. Session tokens remain active for a few minutes allowing attackers to replay tokens acquired via sniffing/MITM attacks and authenticate as the target user...

Tendrl API Session Hijacking Vulnerability

The Tendrl APIs are a set of APIs that provide installation, storage configuration, lifecycle management, monitoring and alerting capabilities for Ceph and Cluster storage. A session hijacking vulnerability exists in the Tendrl API. An attacker could exploit this vulnerability to gain access to...

CVE-2018-1127

Tendrl API in Red Hat Gluster Storage before 3.4.0 does not immediately remove session tokens after a user logs out. Session tokens remain active for a few minutes allowing attackers to replay tokens acquired via sniffing/MITM attacks and authenticate as the target user...