THREATIST.IORead the docs Red Hat Virtualization security and bug fix update
Released 2018-11-05 · Red Hat rating Moderate · View on Red Hat →
Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can result in RCE.
A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bounds checks.
A heap-buffer overflow was found in the way samba clients processed extra long filename in a directory listing.
A flaw was found in RPC request using gfs2_create_req in glusterfs server.
It was found that glusterfs server is vulnerable to multiple stack based buffer overflows due to functions in server-rpc-fopc.c allocating fixed size buffers using 'alloca(3)'.
It was found that glusterfs server does not properly sanitize file paths in the "trusted.io-stats-dump" extended attribute which is used by the "debug/io-stats" translator.
The Gluster file system through versions 4.1.4 and 3.12 is vulnerable to a heap-based buffer overflow in the '__server_getspec' function via the 'gf_getspec_req' RPC message.
A flaw was found in RPC request using gfs3_symlink_req in glusterfs server which allows symlink destinations to point to file paths outside of the gluster volume.
A flaw was found in RPC request using gfs3_mknod_req supported by glusterfs server.
A flaw was found in RPC request using gfs3_lookup_req in glusterfs server.
It was found that the "mknod" call derived from mknod(2) can create files pointing to devices on a glusterfs server node.
A flaw was found in the way dic_unserialize function of glusterfs does not handle negative key length values.
It was found that usage of snprintf function in feature/locks translator of glusterfs server 3.8.4, as shipped with Red Hat Gluster Storage, was vulnerable to a format string attack.
A flaw was found in glusterfs server through versions 4.1.4 and 3.1.2 which allowed repeated usage of GF_META_LOCK_KEY xattr.
The Gluster file system through version 4.1.4 is vulnerable to abuse of the 'features/index' translator.
The Gluster file system through versions 3.12 and 4.1.4 is vulnerable to a buffer overflow in the 'features/index' translator via the code handling the 'GF_XATTR_CLRLK_CMD' xattr in the 'pl_getxattr' function.
The Gluster file system through versions 4.1.4 and 3.1.2 is vulnerable to a denial of service attack via use of the 'GF_XATTR_IOSTATS_DUMP_KEY' xattr.
A flaw was found in RPC request using gfs3_rename_req in glusterfs server.
It was found that an attacker could issue a xattr request via glusterfs FUSE to cause gluster brick process to crash which will result in a remote denial of service.
An information disclosure vulnerability was discovered in glusterfs server.