Read the docs
Red Hat Security Advisory

RHSA-2018:3432

glusterfs security and bug fix update

Released 2018-10-31 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 7 records

TI-2018-10514 CVE-2018-14651 · GHSA-p7qq-cq4p-g2h3

Link following in [UNKNOWN] glusterfs

Priority MEDIUM 44

It was found that the fix for CVE-2018-10927, CVE-2018-10928, CVE-2018-10929, CVE-2018-10930, and CVE-2018-10926 was incomplete.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.03225 Published 2018-10-31 Fixed CWE-59
TI-2018-10516 CVE-2018-14653 · GHSA-947v-4hfw-4p67

Heap-based buffer overflow in glusterfs

Priority MEDIUM 43

The Gluster file system through versions 4.1.4 and 3.12 is vulnerable to a heap-based buffer overflow in the '__server_getspec' function via the 'gf_getspec_req' RPC message.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02769 Published 2018-10-31 Fixed CWE-122
TI-2018-10524 CVE-2018-14661 · GHSA-mhq6-64cp-3vx7

Improper input validation in glusterfs-server

Priority LOW 34

It was found that usage of snprintf function in feature/locks translator of glusterfs server 3.8.4, as shipped with Red Hat Gluster Storage, was vulnerable to a format string attack.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.02655 Published 2018-10-31 Fixed CWE-20
TI-2018-10523 CVE-2018-14660 · GHSA-p6w5-mv25-26mv

Uncontrolled resource consumption in [UNKNOWN] glusterfs

Priority LOW 34

A flaw was found in glusterfs server through versions 4.1.4 and 3.1.2 which allowed repeated usage of GF_META_LOCK_KEY xattr.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.02515 Published 2018-11-01 Fixed CWE-400
TI-2018-10517 CVE-2018-14654 · GHSA-hv7q-959v-864g

Path traversal in glusterfs

Priority LOW 34

The Gluster file system through version 4.1.4 is vulnerable to abuse of the 'features/index' translator.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0263 Published 2018-10-31 Fixed CWE-22
TI-2018-10515 CVE-2018-14652 · GHSA-qg95-5vw5-jwjv

Buffer overflow in glusterfs

Priority LOW 34

The Gluster file system through versions 3.12 and 4.1.4 is vulnerable to a buffer overflow in the 'features/index' translator via the code handling the 'GF_XATTR_CLRLK_CMD' xattr in the 'pl_getxattr' function.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.02747 Published 2018-10-31 Fixed CWE-120
TI-2018-10522 CVE-2018-14659 · GHSA-75jx-33j6-76c5

Uncontrolled resource consumption in glusterfs

Priority LOW 33

The Gluster file system through versions 4.1.4 and 3.1.2 is vulnerable to a denial of service attack via use of the 'GF_XATTR_IOSTATS_DUMP_KEY' xattr.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.02172 Published 2018-10-31 Fixed CWE-400