gluster-block release 0.5.1 is tagged. This is a security and bugfix release. An information-disclosure flaw was found in the way gluster-block logs sensitive information. This flaw allows an attacker with access to the gluster-block logs to read potentially sensitive information, such as the CHAP passwords for block volumes. When tuned to debug log-level, gluster-block captutures the targetcli exec commands output at gluster-blockd.log which might contain sensitive details. Also block volume create/modify/info cli command outputs might contain sensitive information, as part of the audit logging these outputs will be captured at cmd_history.log and gluster-blockd.log (CVE-2020-10762) Administrators may want to check old logs for gluster-block passwords if they created block volumes with CHAP authentication enabled. Restrict access or remove old logs that retain the passwords. The flaw was discovered and fixed by Prasanna Kumar Kalever of Red Hat. Refer: https://access.redhat.com/security/cve/CVE-2020-10762 Notable Fixes: -------------- * Fix CVE-2020-10762 * Fix delete failures when backend file is absent * Add logo for gluster-block project Read more at [1] and [2] [1] https://github.com/gluster/gluster-block/blob/master/README.md [2] https://github.com/gluster/gluster-block/blob/master/INSTALL Cheers!