Read the docs
Red Hat Security Advisory

RHSA-2018:2607

Red Hat Gluster Storage security, bug fix, and enhancement update

Released 2018-09-04 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 11 records

TI-2018-07741 CVE-2018-10929 · GHSA-pmrg-xrj2-vxj8

Improper input validation in Red Hat glusterfs

Priority MEDIUM 44

A flaw was found in RPC request using gfs2_create_req in glusterfs server.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0338 Published 2018-09-04 Fixed CWE-20
TI-2018-07720 CVE-2018-10907 · GHSA-h429-wm24-5m9h

Stack-based buffer overflow in Red Hat glusterfs

Priority MEDIUM 44

It was found that glusterfs server is vulnerable to multiple stack based buffer overflows due to functions in server-rpc-fopc.c allocating fixed size buffers using 'alloca(3)'.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.03338 Published 2018-09-04 Fixed CWE-121
TI-2018-07717 CVE-2018-10904 · GHSA-v93g-8xmc-xvqm

Untrusted search path in Red Hat glusterfs

Priority MEDIUM 44

It was found that glusterfs server does not properly sanitize file paths in the "trusted.io-stats-dump" extended attribute which is used by the "debug/io-stats" translator.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.03 Published 2018-09-04 Fixed CWE-426
TI-2018-07740 CVE-2018-10928 · GHSA-884c-j6hw-f37p

Link following in Red Hat glusterfs

Priority MEDIUM 43

A flaw was found in RPC request using gfs3_symlink_req in glusterfs server which allows symlink destinations to point to file paths outside of the gluster volume.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02678 Published 2018-09-04 Fixed CWE-59
TI-2018-07738 CVE-2018-10926 · GHSA-pjmw-qwj2-f9fg

Improper input validation in Red Hat glusterfs

Priority MEDIUM 43

A flaw was found in RPC request using gfs3_mknod_req supported by glusterfs server.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02579 Published 2018-09-04 Fixed CWE-20
TI-2018-07739 CVE-2018-10927 · GHSA-7pm9-wx72-7c4p

Improper input validation in Red Hat glusterfs

Priority MEDIUM 40

A flaw was found in RPC request using gfs3_lookup_req in glusterfs server.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.0259 Published 2018-09-04 Fixed CWE-20
TI-2018-07735 CVE-2018-10923 · GHSA-gxph-3c78-xmc3

Improper input validation in Red Hat glusterfs

Priority LOW 38

It was found that the "mknod" call derived from mknod(2) can create files pointing to devices on a glusterfs server node.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.01562 Published 2018-09-04 Fixed CWE-20
TI-2018-07723 CVE-2018-10911 · GHSA-x86v-j2gh-g3w6

Integer overflow in Red Hat glusterfs:

Priority LOW 38

A flaw was found in the way dic_unserialize function of glusterfs does not handle negative key length values.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02871 Published 2018-09-04 Fixed CWE-190
TI-2018-07742 CVE-2018-10930 · GHSA-j5jm-3qm8-4wj7

Improper input validation in Red Hat glusterfs

Priority LOW 33

A flaw was found in RPC request using gfs3_rename_req in glusterfs server.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01973 Published 2018-09-04 Fixed CWE-20
TI-2018-07726 CVE-2018-10914 · GHSA-c39g-wmc4-j8vm

NULL pointer dereference in Red Hat glusterfs

Priority LOW 33

It was found that an attacker could issue a xattr request via glusterfs FUSE to cause gluster brick process to crash which will result in a remote denial of service.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.02287 Published 2018-09-04 Fixed CWE-476