rhsa-2018_2608
Vulnerability from csaf_redhat
Published
2018-09-04 06:25
Modified
2024-11-14 23:45
Summary
Red Hat Security Advisory: Red Hat Gluster Storage security, bug fix, and enhancement update
Notes
Topic
Updated glusterfs packages that fix multiple security issues, several bugs, and adds various enhancements are now available for Red Hat Gluster Storage 3.4 on Red Hat Enterprise Linux 6.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
GlusterFS is a key building block of Red Hat Gluster Storage. It is based on a stackable user-space design and can deliver exceptional performance for diverse workloads. GlusterFS aggregates various storage servers over network interconnections into one large, parallel network file system.
Security Fix(es):
* glusterfs: Unsanitized file names in debug/io-stats translator can allow remote attackers to execute arbitrary code (CVE-2018-10904)
* glusterfs: Stack-based buffer overflow in server-rpc-fops.c allows remote attackers to execute arbitrary code (CVE-2018-10907)
* glusterfs: I/O to arbitrary devices on storage server (CVE-2018-10923)
* glusterfs: Device files can be created in arbitrary locations (CVE-2018-10926)
* glusterfs: File status information leak and denial of service (CVE-2018-10927)
* glusterfs: Improper resolution of symlinks allows for privilege escalation (CVE-2018-10928)
* glusterfs: Arbitrary file creation on storage server allows for execution of arbitrary code (CVE-2018-10929)
* glusterfs: Files can be renamed outside volume (CVE-2018-10930)
* glusterfs: Improper deserialization in dict.c:dict_unserialize() can allow attackers to read arbitrary memory (CVE-2018-10911)
* glusterfs: remote denial of service of gluster volumes via posix_get_file_contents function in posix-helpers.c (CVE-2018-10914)
* glusterfs: Information Exposure in posix_get_file_contents function in posix-helpers.c (CVE-2018-10913)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
Red Hat would like to thank Michael Hanselmann (hansmi.ch) for reporting these issues.
Additional changes:
These updated Red Hat Gluster Storage packages include numerous bug fixes and enhancements. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Gluster Storage 3.4 Release Notes for information on the most significant of these changes:
https://access.redhat.com/documentation/en-us/red_hat_gluster_storage/3.4/html/3.4_release_notes/
All users of Red Hat Gluster Storage are advised to upgrade to these updated packages, which provide numerous bug fixes and enhancements.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated glusterfs packages that fix multiple security issues, several bugs, and adds various enhancements are now available for Red Hat Gluster Storage 3.4 on Red Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "GlusterFS is a key building block of Red Hat Gluster Storage. It is based on a stackable user-space design and can deliver exceptional performance for diverse workloads. GlusterFS aggregates various storage servers over network interconnections into one large, parallel network file system.\n\nSecurity Fix(es):\n\n* glusterfs: Unsanitized file names in debug/io-stats translator can allow remote attackers to execute arbitrary code (CVE-2018-10904)\n\n* glusterfs: Stack-based buffer overflow in server-rpc-fops.c allows remote attackers to execute arbitrary code (CVE-2018-10907)\n\n* glusterfs: I/O to arbitrary devices on storage server (CVE-2018-10923)\n\n* glusterfs: Device files can be created in arbitrary locations (CVE-2018-10926)\n\n* glusterfs: File status information leak and denial of service (CVE-2018-10927)\n\n* glusterfs: Improper resolution of symlinks allows for privilege escalation (CVE-2018-10928)\n\n* glusterfs: Arbitrary file creation on storage server allows for execution of arbitrary code (CVE-2018-10929)\n\n* glusterfs: Files can be renamed outside volume (CVE-2018-10930)\n\n* glusterfs: Improper deserialization in dict.c:dict_unserialize() can allow attackers to read arbitrary memory (CVE-2018-10911)\n\n* glusterfs: remote denial of service of gluster volumes via posix_get_file_contents function in posix-helpers.c (CVE-2018-10914)\n\n* glusterfs: Information Exposure in posix_get_file_contents function in posix-helpers.c (CVE-2018-10913)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.\n\nRed Hat would like to thank Michael Hanselmann (hansmi.ch) for reporting these issues.\n\nAdditional changes:\n\nThese updated Red Hat Gluster Storage packages include numerous bug fixes and enhancements. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Gluster Storage 3.4 Release Notes for information on the most significant of these changes:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_gluster_storage/3.4/html/3.4_release_notes/\n\nAll users of Red Hat Gluster Storage are advised to upgrade to these updated packages, which provide numerous bug fixes and enhancements.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2018:2608",
"url": "https://access.redhat.com/errata/RHSA-2018:2608"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-us/red_hat_gluster_storage/3.4/html/3.4_release_notes/",
"url": "https://access.redhat.com/documentation/en-us/red_hat_gluster_storage/3.4/html/3.4_release_notes/"
},
{
"category": "external",
"summary": "1507040",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1507040"
},
{
"category": "external",
"summary": "1507042",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1507042"
},
{
"category": "external",
"summary": "1508777",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1508777"
},
{
"category": "external",
"summary": "1558509",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1558509"
},
{
"category": "external",
"summary": "1569312",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1569312"
},
{
"category": "external",
"summary": "1601298",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601298"
},
{
"category": "external",
"summary": "1601642",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601642"
},
{
"category": "external",
"summary": "1601657",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601657"
},
{
"category": "external",
"summary": "1607617",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1607617"
},
{
"category": "external",
"summary": "1607618",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1607618"
},
{
"category": "external",
"summary": "1610659",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1610659"
},
{
"category": "external",
"summary": "1612658",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1612658"
},
{
"category": "external",
"summary": "1612659",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1612659"
},
{
"category": "external",
"summary": "1612660",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1612660"
},
{
"category": "external",
"summary": "1612664",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1612664"
},
{
"category": "external",
"summary": "1613143",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1613143"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2608.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Gluster Storage security, bug fix, and enhancement update",
"tracking": {
"current_release_date": "2024-11-14T23:45:02+00:00",
"generator": {
"date": "2024-11-14T23:45:02+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2018:2608",
"initial_release_date": "2018-09-04T06:25:24+00:00",
"revision_history": [
{
"date": "2018-09-04T06:25:24+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2018-09-04T16:51:11+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T23:45:02+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Gluster Storage Server 3.4 on RHEL-6",
"product": {
"name": "Red Hat Gluster Storage Server 3.4 on RHEL-6",
"product_id": "6Server-RH-Gluster-3.4-Server",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:storage:3.4:server:el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Storage Native Client for Red Hat Enterprise Linux 6",
"product": {
"name": "Red Hat Storage Native Client for Red Hat Enterprise Linux 6",
"product_id": "6Server-RHSClient",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:storage:3:client:el6"
}
}
}
],
"category": "product_family",
"name": "Red Hat Gluster Storage"
},
{
"branches": [
{
"category": "product_version",
"name": "redhat-storage-server-0:3.4.0.0-1.el6rhs.src",
"product": {
"name": "redhat-storage-server-0:3.4.0.0-1.el6rhs.src",
"product_id": "redhat-storage-server-0:3.4.0.0-1.el6rhs.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/redhat-storage-server@3.4.0.0-1.el6rhs?arch=src"
}
}
},
{
"category": "product_version",
"name": "redhat-release-server-0:6Server-6.10.0.24.el6rhs.src",
"product": {
"name": "redhat-release-server-0:6Server-6.10.0.24.el6rhs.src",
"product_id": "redhat-release-server-0:6Server-6.10.0.24.el6rhs.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/redhat-release-server@6Server-6.10.0.24.el6rhs?arch=src"
}
}
},
{
"category": "product_version",
"name": "glusterfs-0:3.12.2-18.el6rhs.src",
"product": {
"name": "glusterfs-0:3.12.2-18.el6rhs.src",
"product_id": "glusterfs-0:3.12.2-18.el6rhs.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/glusterfs@3.12.2-18.el6rhs?arch=src"
}
}
},
{
"category": "product_version",
"name": "glusterfs-0:3.12.2-18.el6.src",
"product": {
"name": "glusterfs-0:3.12.2-18.el6.src",
"product_id": "glusterfs-0:3.12.2-18.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/glusterfs@3.12.2-18.el6?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "redhat-storage-server-0:3.4.0.0-1.el6rhs.noarch",
"product": {
"name": "redhat-storage-server-0:3.4.0.0-1.el6rhs.noarch",
"product_id": "redhat-storage-server-0:3.4.0.0-1.el6rhs.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/redhat-storage-server@3.4.0.0-1.el6rhs?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "redhat-release-server-0:6Server-6.10.0.24.el6rhs.x86_64",
"product": {
"name": "redhat-release-server-0:6Server-6.10.0.24.el6rhs.x86_64",
"product_id": "redhat-release-server-0:6Server-6.10.0.24.el6rhs.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/redhat-release-server@6Server-6.10.0.24.el6rhs?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "glusterfs-api-devel-0:3.12.2-18.el6rhs.x86_64",
"product": {
"name": "glusterfs-api-devel-0:3.12.2-18.el6rhs.x86_64",
"product_id": "glusterfs-api-devel-0:3.12.2-18.el6rhs.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/glusterfs-api-devel@3.12.2-18.el6rhs?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "glusterfs-fuse-0:3.12.2-18.el6rhs.x86_64",
"product": {
"name": "glusterfs-fuse-0:3.12.2-18.el6rhs.x86_64",
"product_id": "glusterfs-fuse-0:3.12.2-18.el6rhs.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/glusterfs-fuse@3.12.2-18.el6rhs?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "glusterfs-cli-0:3.12.2-18.el6rhs.x86_64",
"product": {
"name": "glusterfs-cli-0:3.12.2-18.el6rhs.x86_64",
"product_id": "glusterfs-cli-0:3.12.2-18.el6rhs.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/glusterfs-cli@3.12.2-18.el6rhs?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "glusterfs-debuginfo-0:3.12.2-18.el6rhs.x86_64",
"product": {
"name": "glusterfs-debuginfo-0:3.12.2-18.el6rhs.x86_64",
"product_id": "glusterfs-debuginfo-0:3.12.2-18.el6rhs.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/glusterfs-debuginfo@3.12.2-18.el6rhs?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "glusterfs-server-0:3.12.2-18.el6rhs.x86_64",
"product": {
"name": "glusterfs-server-0:3.12.2-18.el6rhs.x86_64",
"product_id": "glusterfs-server-0:3.12.2-18.el6rhs.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/glusterfs-server@3.12.2-18.el6rhs?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "glusterfs-ganesha-0:3.12.2-18.el6rhs.x86_64",
"product": {
"name": "glusterfs-ganesha-0:3.12.2-18.el6rhs.x86_64",
"product_id": "glusterfs-ganesha-0:3.12.2-18.el6rhs.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/glusterfs-ganesha@3.12.2-18.el6rhs?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "python2-gluster-0:3.12.2-18.el6rhs.x86_64",
"product": {
"name": "python2-gluster-0:3.12.2-18.el6rhs.x86_64",
"product_id": "python2-gluster-0:3.12.2-18.el6rhs.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python2-gluster@3.12.2-18.el6rhs?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "glusterfs-events-0:3.12.2-18.el6rhs.x86_64",
"product": {
"name": "glusterfs-events-0:3.12.2-18.el6rhs.x86_64",
"product_id": "glusterfs-events-0:3.12.2-18.el6rhs.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/glusterfs-events@3.12.2-18.el6rhs?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "glusterfs-api-0:3.12.2-18.el6rhs.x86_64",
"product": {
"name": "glusterfs-api-0:3.12.2-18.el6rhs.x86_64",
"product_id": "glusterfs-api-0:3.12.2-18.el6rhs.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/glusterfs-api@3.12.2-18.el6rhs?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "glusterfs-geo-replication-0:3.12.2-18.el6rhs.x86_64",
"product": {
"name": "glusterfs-geo-replication-0:3.12.2-18.el6rhs.x86_64",
"product_id": "glusterfs-geo-replication-0:3.12.2-18.el6rhs.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/glusterfs-geo-replication@3.12.2-18.el6rhs?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "glusterfs-0:3.12.2-18.el6rhs.x86_64",
"product": {
"name": "glusterfs-0:3.12.2-18.el6rhs.x86_64",
"product_id": "glusterfs-0:3.12.2-18.el6rhs.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/glusterfs@3.12.2-18.el6rhs?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "glusterfs-rdma-0:3.12.2-18.el6rhs.x86_64",
"product": {
"name": "glusterfs-rdma-0:3.12.2-18.el6rhs.x86_64",
"product_id": "glusterfs-rdma-0:3.12.2-18.el6rhs.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/glusterfs-rdma@3.12.2-18.el6rhs?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "glusterfs-devel-0:3.12.2-18.el6rhs.x86_64",
"product": {
"name": "glusterfs-devel-0:3.12.2-18.el6rhs.x86_64",
"product_id": "glusterfs-devel-0:3.12.2-18.el6rhs.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/glusterfs-devel@3.12.2-18.el6rhs?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "glusterfs-libs-0:3.12.2-18.el6rhs.x86_64",
"product": {
"name": "glusterfs-libs-0:3.12.2-18.el6rhs.x86_64",
"product_id": "glusterfs-libs-0:3.12.2-18.el6rhs.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/glusterfs-libs@3.12.2-18.el6rhs?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "glusterfs-client-xlators-0:3.12.2-18.el6rhs.x86_64",
"product": {
"name": "glusterfs-client-xlators-0:3.12.2-18.el6rhs.x86_64",
"product_id": "glusterfs-client-xlators-0:3.12.2-18.el6rhs.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/glusterfs-client-xlators@3.12.2-18.el6rhs?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "python2-gluster-0:3.12.2-18.el6.x86_64",
"product": {
"name": "python2-gluster-0:3.12.2-18.el6.x86_64",
"product_id": "python2-gluster-0:3.12.2-18.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python2-gluster@3.12.2-18.el6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "glusterfs-libs-0:3.12.2-18.el6.x86_64",
"product": {
"name": "glusterfs-libs-0:3.12.2-18.el6.x86_64",
"product_id": "glusterfs-libs-0:3.12.2-18.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/glusterfs-libs@3.12.2-18.el6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "glusterfs-rdma-0:3.12.2-18.el6.x86_64",
"product": {
"name": "glusterfs-rdma-0:3.12.2-18.el6.x86_64",
"product_id": "glusterfs-rdma-0:3.12.2-18.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/glusterfs-rdma@3.12.2-18.el6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "glusterfs-api-devel-0:3.12.2-18.el6.x86_64",
"product": {
"name": "glusterfs-api-devel-0:3.12.2-18.el6.x86_64",
"product_id": "glusterfs-api-devel-0:3.12.2-18.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/glusterfs-api-devel@3.12.2-18.el6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "glusterfs-cli-0:3.12.2-18.el6.x86_64",
"product": {
"name": "glusterfs-cli-0:3.12.2-18.el6.x86_64",
"product_id": "glusterfs-cli-0:3.12.2-18.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/glusterfs-cli@3.12.2-18.el6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "glusterfs-fuse-0:3.12.2-18.el6.x86_64",
"product": {
"name": "glusterfs-fuse-0:3.12.2-18.el6.x86_64",
"product_id": "glusterfs-fuse-0:3.12.2-18.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/glusterfs-fuse@3.12.2-18.el6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "glusterfs-debuginfo-0:3.12.2-18.el6.x86_64",
"product": {
"name": "glusterfs-debuginfo-0:3.12.2-18.el6.x86_64",
"product_id": "glusterfs-debuginfo-0:3.12.2-18.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/glusterfs-debuginfo@3.12.2-18.el6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "glusterfs-devel-0:3.12.2-18.el6.x86_64",
"product": {
"name": "glusterfs-devel-0:3.12.2-18.el6.x86_64",
"product_id": "glusterfs-devel-0:3.12.2-18.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/glusterfs-devel@3.12.2-18.el6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "glusterfs-client-xlators-0:3.12.2-18.el6.x86_64",
"product": {
"name": "glusterfs-client-xlators-0:3.12.2-18.el6.x86_64",
"product_id": "glusterfs-client-xlators-0:3.12.2-18.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/glusterfs-client-xlators@3.12.2-18.el6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "glusterfs-0:3.12.2-18.el6.x86_64",
"product": {
"name": "glusterfs-0:3.12.2-18.el6.x86_64",
"product_id": "glusterfs-0:3.12.2-18.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/glusterfs@3.12.2-18.el6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "glusterfs-api-0:3.12.2-18.el6.x86_64",
"product": {
"name": "glusterfs-api-0:3.12.2-18.el6.x86_64",
"product_id": "glusterfs-api-0:3.12.2-18.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/glusterfs-api@3.12.2-18.el6?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "glusterfs-0:3.12.2-18.el6rhs.src as a component of Red Hat Gluster Storage Server 3.4 on RHEL-6",
"product_id": "6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.src"
},
"product_reference": "glusterfs-0:3.12.2-18.el6rhs.src",
"relates_to_product_reference": "6Server-RH-Gluster-3.4-Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "glusterfs-0:3.12.2-18.el6rhs.x86_64 as a component of Red Hat Gluster Storage Server 3.4 on RHEL-6",
"product_id": "6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.x86_64"
},
"product_reference": "glusterfs-0:3.12.2-18.el6rhs.x86_64",
"relates_to_product_reference": "6Server-RH-Gluster-3.4-Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "glusterfs-api-0:3.12.2-18.el6rhs.x86_64 as a component of Red Hat Gluster Storage Server 3.4 on RHEL-6",
"product_id": "6Server-RH-Gluster-3.4-Server:glusterfs-api-0:3.12.2-18.el6rhs.x86_64"
},
"product_reference": "glusterfs-api-0:3.12.2-18.el6rhs.x86_64",
"relates_to_product_reference": "6Server-RH-Gluster-3.4-Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "glusterfs-api-devel-0:3.12.2-18.el6rhs.x86_64 as a component of Red Hat Gluster Storage Server 3.4 on RHEL-6",
"product_id": "6Server-RH-Gluster-3.4-Server:glusterfs-api-devel-0:3.12.2-18.el6rhs.x86_64"
},
"product_reference": "glusterfs-api-devel-0:3.12.2-18.el6rhs.x86_64",
"relates_to_product_reference": "6Server-RH-Gluster-3.4-Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "glusterfs-cli-0:3.12.2-18.el6rhs.x86_64 as a component of Red Hat Gluster Storage Server 3.4 on RHEL-6",
"product_id": "6Server-RH-Gluster-3.4-Server:glusterfs-cli-0:3.12.2-18.el6rhs.x86_64"
},
"product_reference": "glusterfs-cli-0:3.12.2-18.el6rhs.x86_64",
"relates_to_product_reference": "6Server-RH-Gluster-3.4-Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "glusterfs-client-xlators-0:3.12.2-18.el6rhs.x86_64 as a component of Red Hat Gluster Storage Server 3.4 on RHEL-6",
"product_id": "6Server-RH-Gluster-3.4-Server:glusterfs-client-xlators-0:3.12.2-18.el6rhs.x86_64"
},
"product_reference": "glusterfs-client-xlators-0:3.12.2-18.el6rhs.x86_64",
"relates_to_product_reference": "6Server-RH-Gluster-3.4-Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "glusterfs-debuginfo-0:3.12.2-18.el6rhs.x86_64 as a component of Red Hat Gluster Storage Server 3.4 on RHEL-6",
"product_id": "6Server-RH-Gluster-3.4-Server:glusterfs-debuginfo-0:3.12.2-18.el6rhs.x86_64"
},
"product_reference": "glusterfs-debuginfo-0:3.12.2-18.el6rhs.x86_64",
"relates_to_product_reference": "6Server-RH-Gluster-3.4-Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "glusterfs-devel-0:3.12.2-18.el6rhs.x86_64 as a component of Red Hat Gluster Storage Server 3.4 on RHEL-6",
"product_id": "6Server-RH-Gluster-3.4-Server:glusterfs-devel-0:3.12.2-18.el6rhs.x86_64"
},
"product_reference": "glusterfs-devel-0:3.12.2-18.el6rhs.x86_64",
"relates_to_product_reference": "6Server-RH-Gluster-3.4-Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "glusterfs-events-0:3.12.2-18.el6rhs.x86_64 as a component of Red Hat Gluster Storage Server 3.4 on RHEL-6",
"product_id": "6Server-RH-Gluster-3.4-Server:glusterfs-events-0:3.12.2-18.el6rhs.x86_64"
},
"product_reference": "glusterfs-events-0:3.12.2-18.el6rhs.x86_64",
"relates_to_product_reference": "6Server-RH-Gluster-3.4-Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "glusterfs-fuse-0:3.12.2-18.el6rhs.x86_64 as a component of Red Hat Gluster Storage Server 3.4 on RHEL-6",
"product_id": "6Server-RH-Gluster-3.4-Server:glusterfs-fuse-0:3.12.2-18.el6rhs.x86_64"
},
"product_reference": "glusterfs-fuse-0:3.12.2-18.el6rhs.x86_64",
"relates_to_product_reference": "6Server-RH-Gluster-3.4-Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "glusterfs-ganesha-0:3.12.2-18.el6rhs.x86_64 as a component of Red Hat Gluster Storage Server 3.4 on RHEL-6",
"product_id": "6Server-RH-Gluster-3.4-Server:glusterfs-ganesha-0:3.12.2-18.el6rhs.x86_64"
},
"product_reference": "glusterfs-ganesha-0:3.12.2-18.el6rhs.x86_64",
"relates_to_product_reference": "6Server-RH-Gluster-3.4-Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "glusterfs-geo-replication-0:3.12.2-18.el6rhs.x86_64 as a component of Red Hat Gluster Storage Server 3.4 on RHEL-6",
"product_id": "6Server-RH-Gluster-3.4-Server:glusterfs-geo-replication-0:3.12.2-18.el6rhs.x86_64"
},
"product_reference": "glusterfs-geo-replication-0:3.12.2-18.el6rhs.x86_64",
"relates_to_product_reference": "6Server-RH-Gluster-3.4-Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "glusterfs-libs-0:3.12.2-18.el6rhs.x86_64 as a component of Red Hat Gluster Storage Server 3.4 on RHEL-6",
"product_id": "6Server-RH-Gluster-3.4-Server:glusterfs-libs-0:3.12.2-18.el6rhs.x86_64"
},
"product_reference": "glusterfs-libs-0:3.12.2-18.el6rhs.x86_64",
"relates_to_product_reference": "6Server-RH-Gluster-3.4-Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "glusterfs-rdma-0:3.12.2-18.el6rhs.x86_64 as a component of Red Hat Gluster Storage Server 3.4 on RHEL-6",
"product_id": "6Server-RH-Gluster-3.4-Server:glusterfs-rdma-0:3.12.2-18.el6rhs.x86_64"
},
"product_reference": "glusterfs-rdma-0:3.12.2-18.el6rhs.x86_64",
"relates_to_product_reference": "6Server-RH-Gluster-3.4-Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "glusterfs-server-0:3.12.2-18.el6rhs.x86_64 as a component of Red Hat Gluster Storage Server 3.4 on RHEL-6",
"product_id": "6Server-RH-Gluster-3.4-Server:glusterfs-server-0:3.12.2-18.el6rhs.x86_64"
},
"product_reference": "glusterfs-server-0:3.12.2-18.el6rhs.x86_64",
"relates_to_product_reference": "6Server-RH-Gluster-3.4-Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python2-gluster-0:3.12.2-18.el6rhs.x86_64 as a component of Red Hat Gluster Storage Server 3.4 on RHEL-6",
"product_id": "6Server-RH-Gluster-3.4-Server:python2-gluster-0:3.12.2-18.el6rhs.x86_64"
},
"product_reference": "python2-gluster-0:3.12.2-18.el6rhs.x86_64",
"relates_to_product_reference": "6Server-RH-Gluster-3.4-Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "redhat-release-server-0:6Server-6.10.0.24.el6rhs.src as a component of Red Hat Gluster Storage Server 3.4 on RHEL-6",
"product_id": "6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.src"
},
"product_reference": "redhat-release-server-0:6Server-6.10.0.24.el6rhs.src",
"relates_to_product_reference": "6Server-RH-Gluster-3.4-Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "redhat-release-server-0:6Server-6.10.0.24.el6rhs.x86_64 as a component of Red Hat Gluster Storage Server 3.4 on RHEL-6",
"product_id": "6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.x86_64"
},
"product_reference": "redhat-release-server-0:6Server-6.10.0.24.el6rhs.x86_64",
"relates_to_product_reference": "6Server-RH-Gluster-3.4-Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "redhat-storage-server-0:3.4.0.0-1.el6rhs.noarch as a component of Red Hat Gluster Storage Server 3.4 on RHEL-6",
"product_id": "6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.noarch"
},
"product_reference": "redhat-storage-server-0:3.4.0.0-1.el6rhs.noarch",
"relates_to_product_reference": "6Server-RH-Gluster-3.4-Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "redhat-storage-server-0:3.4.0.0-1.el6rhs.src as a component of Red Hat Gluster Storage Server 3.4 on RHEL-6",
"product_id": "6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.src"
},
"product_reference": "redhat-storage-server-0:3.4.0.0-1.el6rhs.src",
"relates_to_product_reference": "6Server-RH-Gluster-3.4-Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "glusterfs-0:3.12.2-18.el6.src as a component of Red Hat Storage Native Client for Red Hat Enterprise Linux 6",
"product_id": "6Server-RHSClient:glusterfs-0:3.12.2-18.el6.src"
},
"product_reference": "glusterfs-0:3.12.2-18.el6.src",
"relates_to_product_reference": "6Server-RHSClient"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "glusterfs-0:3.12.2-18.el6.x86_64 as a component of Red Hat Storage Native Client for Red Hat Enterprise Linux 6",
"product_id": "6Server-RHSClient:glusterfs-0:3.12.2-18.el6.x86_64"
},
"product_reference": "glusterfs-0:3.12.2-18.el6.x86_64",
"relates_to_product_reference": "6Server-RHSClient"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "glusterfs-api-0:3.12.2-18.el6.x86_64 as a component of Red Hat Storage Native Client for Red Hat Enterprise Linux 6",
"product_id": "6Server-RHSClient:glusterfs-api-0:3.12.2-18.el6.x86_64"
},
"product_reference": "glusterfs-api-0:3.12.2-18.el6.x86_64",
"relates_to_product_reference": "6Server-RHSClient"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "glusterfs-api-devel-0:3.12.2-18.el6.x86_64 as a component of Red Hat Storage Native Client for Red Hat Enterprise Linux 6",
"product_id": "6Server-RHSClient:glusterfs-api-devel-0:3.12.2-18.el6.x86_64"
},
"product_reference": "glusterfs-api-devel-0:3.12.2-18.el6.x86_64",
"relates_to_product_reference": "6Server-RHSClient"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "glusterfs-cli-0:3.12.2-18.el6.x86_64 as a component of Red Hat Storage Native Client for Red Hat Enterprise Linux 6",
"product_id": "6Server-RHSClient:glusterfs-cli-0:3.12.2-18.el6.x86_64"
},
"product_reference": "glusterfs-cli-0:3.12.2-18.el6.x86_64",
"relates_to_product_reference": "6Server-RHSClient"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "glusterfs-client-xlators-0:3.12.2-18.el6.x86_64 as a component of Red Hat Storage Native Client for Red Hat Enterprise Linux 6",
"product_id": "6Server-RHSClient:glusterfs-client-xlators-0:3.12.2-18.el6.x86_64"
},
"product_reference": "glusterfs-client-xlators-0:3.12.2-18.el6.x86_64",
"relates_to_product_reference": "6Server-RHSClient"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "glusterfs-debuginfo-0:3.12.2-18.el6.x86_64 as a component of Red Hat Storage Native Client for Red Hat Enterprise Linux 6",
"product_id": "6Server-RHSClient:glusterfs-debuginfo-0:3.12.2-18.el6.x86_64"
},
"product_reference": "glusterfs-debuginfo-0:3.12.2-18.el6.x86_64",
"relates_to_product_reference": "6Server-RHSClient"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "glusterfs-devel-0:3.12.2-18.el6.x86_64 as a component of Red Hat Storage Native Client for Red Hat Enterprise Linux 6",
"product_id": "6Server-RHSClient:glusterfs-devel-0:3.12.2-18.el6.x86_64"
},
"product_reference": "glusterfs-devel-0:3.12.2-18.el6.x86_64",
"relates_to_product_reference": "6Server-RHSClient"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "glusterfs-fuse-0:3.12.2-18.el6.x86_64 as a component of Red Hat Storage Native Client for Red Hat Enterprise Linux 6",
"product_id": "6Server-RHSClient:glusterfs-fuse-0:3.12.2-18.el6.x86_64"
},
"product_reference": "glusterfs-fuse-0:3.12.2-18.el6.x86_64",
"relates_to_product_reference": "6Server-RHSClient"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "glusterfs-libs-0:3.12.2-18.el6.x86_64 as a component of Red Hat Storage Native Client for Red Hat Enterprise Linux 6",
"product_id": "6Server-RHSClient:glusterfs-libs-0:3.12.2-18.el6.x86_64"
},
"product_reference": "glusterfs-libs-0:3.12.2-18.el6.x86_64",
"relates_to_product_reference": "6Server-RHSClient"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "glusterfs-rdma-0:3.12.2-18.el6.x86_64 as a component of Red Hat Storage Native Client for Red Hat Enterprise Linux 6",
"product_id": "6Server-RHSClient:glusterfs-rdma-0:3.12.2-18.el6.x86_64"
},
"product_reference": "glusterfs-rdma-0:3.12.2-18.el6.x86_64",
"relates_to_product_reference": "6Server-RHSClient"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python2-gluster-0:3.12.2-18.el6.x86_64 as a component of Red Hat Storage Native Client for Red Hat Enterprise Linux 6",
"product_id": "6Server-RHSClient:python2-gluster-0:3.12.2-18.el6.x86_64"
},
"product_reference": "python2-gluster-0:3.12.2-18.el6.x86_64",
"relates_to_product_reference": "6Server-RHSClient"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Michael Hanselmann"
],
"organization": "hansmi.ch"
}
],
"cve": "CVE-2018-10904",
"cwe": {
"id": "CWE-426",
"name": "Untrusted Search Path"
},
"discovery_date": "2018-07-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1601298"
}
],
"notes": [
{
"category": "description",
"text": "It was found that glusterfs server does not properly sanitize file paths in the \"trusted.io-stats-dump\" extended attribute which is used by the \"debug/io-stats\" translator. An attacker can use this flaw to create files and execute arbitrary code. To exploit this, the attacker would require sufficient access to modify the extended attributes of files on a gluster volume.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glusterfs: Unsanitized file names in debug/io-stats translator can allow remote attackers to execute arbitrary code",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue did not affect Red Hat Enterprise Linux 6 and 7 as the flaw is present in glusterfs-server, which is not shipped there.\n\nThis flaw affects glusterfs versions included in Red Hat Virtualization 4 Hypervisor. However, in recommended configurations, the vulnerability is only exposed to hypervisor administrators and can not be exploited from virtual machines or other hosts on the network. For Red Hat Virtualization, Product Security has rated this flaw as Moderate. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-cli-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-client-xlators-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-debuginfo-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-events-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-fuse-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-ganesha-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-geo-replication-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-libs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-rdma-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-server-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:python2-gluster-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.noarch",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-cli-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-client-xlators-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-debuginfo-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-fuse-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-libs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-rdma-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:python2-gluster-0:3.12.2-18.el6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2018-10904"
},
{
"category": "external",
"summary": "RHBZ#1601298",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601298"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2018-10904",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-10904"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-10904",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10904"
}
],
"release_date": "2018-09-04T05:30:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2018-09-04T06:25:24+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-cli-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-client-xlators-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-debuginfo-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-events-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-fuse-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-ganesha-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-geo-replication-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-libs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-rdma-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-server-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:python2-gluster-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.noarch",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-cli-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-client-xlators-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-debuginfo-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-fuse-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-libs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-rdma-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:python2-gluster-0:3.12.2-18.el6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2018:2608"
},
{
"category": "workaround",
"details": "To limit exposure of gluster server nodes : \n\n1. gluster server should be on LAN and not reachable from public networks. \n2. Use gluster auth.allow and auth.reject. \n3. Use TLS certificates to authenticate gluster clients.\n\ncaveat: This does not protect from attacks against authenticated gluster clients.",
"product_ids": [
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-cli-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-client-xlators-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-debuginfo-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-events-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-fuse-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-ganesha-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-geo-replication-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-libs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-rdma-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-server-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:python2-gluster-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.noarch",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-cli-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-client-xlators-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-debuginfo-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-fuse-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-libs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-rdma-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:python2-gluster-0:3.12.2-18.el6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-cli-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-client-xlators-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-debuginfo-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-events-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-fuse-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-ganesha-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-geo-replication-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-libs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-rdma-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-server-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:python2-gluster-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.noarch",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-cli-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-client-xlators-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-debuginfo-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-fuse-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-libs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-rdma-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:python2-gluster-0:3.12.2-18.el6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "glusterfs: Unsanitized file names in debug/io-stats translator can allow remote attackers to execute arbitrary code"
},
{
"acknowledgments": [
{
"names": [
"Michael Hanselmann"
],
"organization": "hansmi.ch"
}
],
"cve": "CVE-2018-10907",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"discovery_date": "2018-07-17T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1601642"
}
],
"notes": [
{
"category": "description",
"text": "It was found that glusterfs server is vulnerable to mulitple stack based buffer overflows due to functions in server-rpc-fopc.c allocating fixed size buffers using \u0027alloca(3)\u0027. An authenticated attacker could exploit this by mounting a gluster volume and sending a string longer that the fixed buffer size to cause crash or potential code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glusterfs: Stack-based buffer overflow in server-rpc-fops.c allows remote attackers to execute arbitrary code",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue did not affect Red Hat Enterprise Linux 6 and 7 as the flaw is present in glusterfs-server, which is not shipped there.\n\nThis flaw affects glusterfs versions included in Red Hat Virtualization 4 Hypervisor. However, in recommended configurations, the vulnerability is only exposed to hypervisor administrators and can not be exploited from virtual machines or other hosts on the network. For Red Hat Virtualization, Product Security has rated this flaw as Moderate. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-cli-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-client-xlators-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-debuginfo-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-events-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-fuse-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-ganesha-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-geo-replication-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-libs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-rdma-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-server-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:python2-gluster-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.noarch",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-cli-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-client-xlators-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-debuginfo-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-fuse-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-libs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-rdma-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:python2-gluster-0:3.12.2-18.el6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2018-10907"
},
{
"category": "external",
"summary": "RHBZ#1601642",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601642"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2018-10907",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-10907"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-10907",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10907"
}
],
"release_date": "2018-09-04T05:30:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2018-09-04T06:25:24+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-cli-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-client-xlators-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-debuginfo-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-events-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-fuse-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-ganesha-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-geo-replication-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-libs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-rdma-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-server-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:python2-gluster-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.noarch",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-cli-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-client-xlators-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-debuginfo-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-fuse-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-libs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-rdma-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:python2-gluster-0:3.12.2-18.el6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2018:2608"
},
{
"category": "workaround",
"details": "To limit exposure of gluster server nodes : \n\n1. gluster server should be on LAN and not reachable from public networks. \n2. Use gluster auth.allow and auth.reject. \n3. Use TLS certificates to authenticate gluster clients.\n\ncaveat: This does not protect from attacks by authenticated gluster clients.",
"product_ids": [
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-cli-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-client-xlators-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-debuginfo-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-events-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-fuse-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-ganesha-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-geo-replication-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-libs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-rdma-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-server-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:python2-gluster-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.noarch",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-cli-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-client-xlators-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-debuginfo-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-fuse-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-libs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-rdma-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:python2-gluster-0:3.12.2-18.el6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-cli-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-client-xlators-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-debuginfo-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-events-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-fuse-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-ganesha-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-geo-replication-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-libs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-rdma-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-server-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:python2-gluster-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.noarch",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-cli-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-client-xlators-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-debuginfo-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-fuse-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-libs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-rdma-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:python2-gluster-0:3.12.2-18.el6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "glusterfs: Stack-based buffer overflow in server-rpc-fops.c allows remote attackers to execute arbitrary code"
},
{
"acknowledgments": [
{
"names": [
"Michael Hanselmann"
],
"organization": "hansmi.ch"
}
],
"cve": "CVE-2018-10911",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2018-07-17T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1601657"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in dict.c:dict_unserialize function of glusterfs, dic_unserialize function does not handle negative key length values. An attacker could use this flaw to read memory from other locations into the stored dict value.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glusterfs: Improper deserialization in dict.c:dict_unserialize() can allow attackers to read arbitrary memory",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw affects glusterfs versions included in Red Hat Virtualization 4 Hypervisor. However, in recommended configurations, the vulnerability is only exposed to hypervisor administrators and can not be exploited from virtual machines or other hosts on the network. For Red Hat Virtualization, Product Security has rated this flaw as Moderate. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-cli-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-client-xlators-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-debuginfo-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-events-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-fuse-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-ganesha-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-geo-replication-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-libs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-rdma-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-server-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:python2-gluster-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.noarch",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-cli-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-client-xlators-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-debuginfo-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-fuse-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-libs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-rdma-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:python2-gluster-0:3.12.2-18.el6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2018-10911"
},
{
"category": "external",
"summary": "RHBZ#1601657",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601657"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2018-10911",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-10911"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-10911",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10911"
}
],
"release_date": "2018-09-04T05:30:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2018-09-04T06:25:24+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-cli-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-client-xlators-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-debuginfo-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-events-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-fuse-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-ganesha-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-geo-replication-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-libs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-rdma-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-server-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:python2-gluster-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.noarch",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-cli-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-client-xlators-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-debuginfo-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-fuse-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-libs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-rdma-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:python2-gluster-0:3.12.2-18.el6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2018:2608"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"products": [
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-cli-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-client-xlators-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-debuginfo-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-events-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-fuse-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-ganesha-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-geo-replication-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-libs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-rdma-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-server-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:python2-gluster-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.noarch",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-cli-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-client-xlators-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-debuginfo-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-fuse-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-libs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-rdma-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:python2-gluster-0:3.12.2-18.el6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "glusterfs: Improper deserialization in dict.c:dict_unserialize() can allow attackers to read arbitrary memory"
},
{
"acknowledgments": [
{
"names": [
"Michael Hanselmann"
],
"organization": "hansmi.ch"
}
],
"cve": "CVE-2018-10913",
"cwe": {
"id": "CWE-209",
"name": "Generation of Error Message Containing Sensitive Information"
},
"discovery_date": "2018-07-23T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1607618"
}
],
"notes": [
{
"category": "description",
"text": "An information disclosure vulnerability was discovered in glusterfs server. An attacker could issue a xattr request via glusterfs FUSE to determine the existence of any file.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glusterfs: Information Exposure in posix_get_file_contents function in posix-helpers.c",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue did not affect Red Hat Enterprise Linux 6 and 7 as the flaw is present in glusterfs-server, which is not shipped there.\n\nThis flaw affects glusterfs versions included in Red Hat Virtualization 4 Hypervisor. However, in recommended configurations, the vulnerability is only exposed to hypervisor administrators and can not be exploited from virtual machines or other hosts on the network.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-cli-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-client-xlators-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-debuginfo-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-events-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-fuse-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-ganesha-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-geo-replication-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-libs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-rdma-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-server-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:python2-gluster-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.noarch",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-cli-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-client-xlators-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-debuginfo-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-fuse-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-libs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-rdma-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:python2-gluster-0:3.12.2-18.el6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2018-10913"
},
{
"category": "external",
"summary": "RHBZ#1607618",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1607618"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2018-10913",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-10913"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-10913",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10913"
}
],
"release_date": "2018-09-04T05:30:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2018-09-04T06:25:24+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-cli-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-client-xlators-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-debuginfo-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-events-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-fuse-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-ganesha-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-geo-replication-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-libs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-rdma-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-server-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:python2-gluster-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.noarch",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-cli-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-client-xlators-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-debuginfo-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-fuse-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-libs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-rdma-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:python2-gluster-0:3.12.2-18.el6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2018:2608"
},
{
"category": "workaround",
"details": "SELinux mitigates this issue on Red Hat Gluster Storage 3. SELinux should be in enforcing mode only as permissive mode does not block attacks.",
"product_ids": [
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-cli-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-client-xlators-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-debuginfo-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-events-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-fuse-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-ganesha-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-geo-replication-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-libs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-rdma-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-server-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:python2-gluster-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.noarch",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-cli-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-client-xlators-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-debuginfo-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-fuse-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-libs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-rdma-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:python2-gluster-0:3.12.2-18.el6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-cli-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-client-xlators-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-debuginfo-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-events-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-fuse-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-ganesha-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-geo-replication-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-libs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-rdma-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-server-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:python2-gluster-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.noarch",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-cli-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-client-xlators-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-debuginfo-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-fuse-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-libs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-rdma-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:python2-gluster-0:3.12.2-18.el6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "glusterfs: Information Exposure in posix_get_file_contents function in posix-helpers.c"
},
{
"acknowledgments": [
{
"names": [
"Michael Hanselmann"
],
"organization": "hansmi.ch"
}
],
"cve": "CVE-2018-10914",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2018-07-23T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1607617"
}
],
"notes": [
{
"category": "description",
"text": "It was found that an attacker could issue a xattr request via glusterfs FUSE to cause gluster brick process to crash which will result in a remote denial of service. If gluster multiplexing is enabled this will result in a crash of multiple bricks and gluster volumes.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glusterfs: remote denial of service of gluster volumes via posix_get_file_contents function in posix-helpers.c",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue did not affect Red Hat Enterprise Linux 6 and 7 as the flaw is present in glusterfs-server, which is not shipped there.\n\nThis flaw affects glusterfs versions included in Red Hat Virtualization 4 Hypervisor. However, in recommended configurations, the vulnerability is only exposed to hypervisor administrators and can not be exploited from virtual machines or other hosts on the network.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-cli-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-client-xlators-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-debuginfo-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-events-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-fuse-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-ganesha-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-geo-replication-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-libs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-rdma-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-server-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:python2-gluster-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.noarch",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-cli-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-client-xlators-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-debuginfo-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-fuse-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-libs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-rdma-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:python2-gluster-0:3.12.2-18.el6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2018-10914"
},
{
"category": "external",
"summary": "RHBZ#1607617",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1607617"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2018-10914",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-10914"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-10914",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10914"
}
],
"release_date": "2018-09-04T05:30:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2018-09-04T06:25:24+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-cli-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-client-xlators-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-debuginfo-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-events-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-fuse-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-ganesha-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-geo-replication-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-libs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-rdma-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-server-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:python2-gluster-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.noarch",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-cli-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-client-xlators-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-debuginfo-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-fuse-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-libs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-rdma-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:python2-gluster-0:3.12.2-18.el6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2018:2608"
},
{
"category": "workaround",
"details": "SELinux mitigates this issue on Red Hat Gluster Storage 3. SELinux should be in enforcing mode only as permissive mode does not block attacks.",
"product_ids": [
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-cli-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-client-xlators-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-debuginfo-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-events-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-fuse-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-ganesha-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-geo-replication-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-libs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-rdma-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-server-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:python2-gluster-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.noarch",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-cli-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-client-xlators-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-debuginfo-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-fuse-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-libs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-rdma-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:python2-gluster-0:3.12.2-18.el6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-cli-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-client-xlators-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-debuginfo-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-events-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-fuse-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-ganesha-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-geo-replication-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-libs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-rdma-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-server-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:python2-gluster-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.noarch",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-cli-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-client-xlators-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-debuginfo-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-fuse-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-libs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-rdma-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:python2-gluster-0:3.12.2-18.el6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "glusterfs: remote denial of service of gluster volumes via posix_get_file_contents function in posix-helpers.c"
},
{
"acknowledgments": [
{
"names": [
"Michael Hanselmann"
],
"organization": "hansmi.ch"
}
],
"cve": "CVE-2018-10923",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2018-07-30T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1610659"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the \"mknod\" call derived from mknod(2) can create files pointing to devices on a glusterfs server node. An authenticated attacker could use this to create an arbitrary device and read data from any device attached to the glusterfs server node.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glusterfs: I/O to arbitrary devices on storage server",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue did not affect Red Hat Enterprise Linux 6 and 7 as the flaw is present in glusterfs-server, which is not shipped there.\n\nThis flaw affects glusterfs versions included in Red Hat Virtualization 4 Hypervisor. However, in recommended configurations, the vulnerability is only exposed to hypervisor administrators and can not be exploited from virtual machines or other hosts on the network. For Red Hat Virtualization, Product Security has rated this flaw as Moderate. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-cli-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-client-xlators-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-debuginfo-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-events-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-fuse-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-ganesha-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-geo-replication-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-libs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-rdma-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-server-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:python2-gluster-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.noarch",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-cli-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-client-xlators-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-debuginfo-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-fuse-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-libs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-rdma-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:python2-gluster-0:3.12.2-18.el6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2018-10923"
},
{
"category": "external",
"summary": "RHBZ#1610659",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1610659"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2018-10923",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-10923"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-10923",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10923"
}
],
"release_date": "2018-09-04T05:30:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2018-09-04T06:25:24+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-cli-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-client-xlators-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-debuginfo-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-events-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-fuse-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-ganesha-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-geo-replication-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-libs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-rdma-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-server-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:python2-gluster-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.noarch",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-cli-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-client-xlators-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-debuginfo-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-fuse-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-libs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-rdma-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:python2-gluster-0:3.12.2-18.el6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2018:2608"
},
{
"category": "workaround",
"details": "To limit exposure of gluster server nodes : \n\n1. gluster server should be on LAN and not reachable from public networks. \n2. Use gluster auth.allow and auth.reject. \n3. Use TLS certificates to authenticate gluster clients.\n\ncaveat: This does not protect from attacks by authenticated gluster clients.",
"product_ids": [
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-cli-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-client-xlators-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-debuginfo-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-events-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-fuse-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-ganesha-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-geo-replication-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-libs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-rdma-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-server-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:python2-gluster-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.noarch",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-cli-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-client-xlators-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-debuginfo-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-fuse-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-libs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-rdma-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:python2-gluster-0:3.12.2-18.el6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
"version": "3.0"
},
"products": [
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-cli-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-client-xlators-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-debuginfo-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-events-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-fuse-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-ganesha-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-geo-replication-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-libs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-rdma-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-server-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:python2-gluster-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.noarch",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-cli-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-client-xlators-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-debuginfo-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-fuse-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-libs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-rdma-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:python2-gluster-0:3.12.2-18.el6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "glusterfs: I/O to arbitrary devices on storage server"
},
{
"acknowledgments": [
{
"names": [
"Michael Hanselmann"
],
"organization": "hansmi.ch"
}
],
"cve": "CVE-2018-10926",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2018-07-30T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1613143"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in RPC request using gfs3_mknod_req supported by glusterfs server. An authenticated attacker could use this flaw to write files to an arbitrary location via path traversal and execute arbitrary code on a glusterfs server node.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glusterfs: Device files can be created in arbitrary locations",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue did not affect Red Hat Enterprise Linux 6 and 7 as the flaw is present in glusterfs-server, which is not shipped there.\n\nThis flaw affects glusterfs versions included in Red Hat Virtualization 4 Hypervisor. However, in recommended configurations, the vulnerability is only exposed to hypervisor administrators and can not be exploited from virtual machines or other hosts on the network. For Red Hat Virtualization, Product Security has rated this flaw as Moderate. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-cli-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-client-xlators-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-debuginfo-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-events-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-fuse-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-ganesha-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-geo-replication-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-libs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-rdma-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-server-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:python2-gluster-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.noarch",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-cli-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-client-xlators-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-debuginfo-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-fuse-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-libs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-rdma-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:python2-gluster-0:3.12.2-18.el6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2018-10926"
},
{
"category": "external",
"summary": "RHBZ#1613143",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1613143"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2018-10926",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-10926"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-10926",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10926"
}
],
"release_date": "2018-09-04T05:30:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2018-09-04T06:25:24+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-cli-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-client-xlators-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-debuginfo-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-events-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-fuse-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-ganesha-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-geo-replication-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-libs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-rdma-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-server-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:python2-gluster-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.noarch",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-cli-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-client-xlators-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-debuginfo-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-fuse-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-libs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-rdma-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:python2-gluster-0:3.12.2-18.el6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2018:2608"
},
{
"category": "workaround",
"details": "To limit exposure of gluster server nodes : \n\n1. gluster server should be on LAN and not reachable from public networks. \n2. Use gluster auth.allow and auth.reject. \n3. Use TLS certificates to authenticate gluster clients.\n\ncaveat: This does not protect from attacks by authenticated gluster clients.",
"product_ids": [
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-cli-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-client-xlators-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-debuginfo-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-events-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-fuse-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-ganesha-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-geo-replication-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-libs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-rdma-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-server-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:python2-gluster-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.noarch",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-cli-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-client-xlators-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-debuginfo-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-fuse-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-libs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-rdma-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:python2-gluster-0:3.12.2-18.el6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.0"
},
"products": [
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-cli-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-client-xlators-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-debuginfo-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-events-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-fuse-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-ganesha-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-geo-replication-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-libs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-rdma-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-server-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:python2-gluster-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.noarch",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-cli-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-client-xlators-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-debuginfo-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-fuse-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-libs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-rdma-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:python2-gluster-0:3.12.2-18.el6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "glusterfs: Device files can be created in arbitrary locations"
},
{
"acknowledgments": [
{
"names": [
"Michael Hanselmann"
],
"organization": "hansmi.ch"
}
],
"cve": "CVE-2018-10927",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2018-07-30T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1612658"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in RPC request using gfs3_lookup_req in glusterfs server. An authenticated attacker could use this flaw to leak information and execute remote denial of service by crashing gluster brick process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glusterfs: File status information leak and denial of service",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue did not affect Red Hat Enterprise Linux 6 and 7 as the flaw is present in glusterfs-server, which is not shipped there.\n\nThis flaw affects glusterfs versions included in Red Hat Virtualization 4 Hypervisor. However, in recommended configurations, the vulnerability is only exposed to hypervisor administrators and can not be exploited from virtual machines or other hosts on the network. For Red Hat Virtualization, Product Security has rated this flaw as Moderate. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-cli-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-client-xlators-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-debuginfo-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-events-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-fuse-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-ganesha-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-geo-replication-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-libs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-rdma-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-server-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:python2-gluster-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.noarch",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-cli-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-client-xlators-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-debuginfo-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-fuse-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-libs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-rdma-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:python2-gluster-0:3.12.2-18.el6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2018-10927"
},
{
"category": "external",
"summary": "RHBZ#1612658",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1612658"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2018-10927",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-10927"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-10927",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10927"
}
],
"release_date": "2018-09-04T05:30:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2018-09-04T06:25:24+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-cli-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-client-xlators-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-debuginfo-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-events-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-fuse-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-ganesha-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-geo-replication-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-libs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-rdma-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-server-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:python2-gluster-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.noarch",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-cli-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-client-xlators-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-debuginfo-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-fuse-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-libs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-rdma-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:python2-gluster-0:3.12.2-18.el6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2018:2608"
},
{
"category": "workaround",
"details": "To limit exposure of gluster server nodes : \n\n1. gluster server should be on LAN and not reachable from public networks. \n2. Use gluster auth.allow and auth.reject. \n3. Use TLS certificates to authenticate gluster clients.\n\ncaveat: This does not protect from attacks by authenticated gluster clients.",
"product_ids": [
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-cli-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-client-xlators-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-debuginfo-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-events-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-fuse-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-ganesha-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-geo-replication-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-libs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-rdma-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-server-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:python2-gluster-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.noarch",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-cli-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-client-xlators-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-debuginfo-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-fuse-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-libs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-rdma-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:python2-gluster-0:3.12.2-18.el6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H",
"version": "3.0"
},
"products": [
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-cli-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-client-xlators-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-debuginfo-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-events-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-fuse-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-ganesha-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-geo-replication-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-libs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-rdma-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-server-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:python2-gluster-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.noarch",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-cli-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-client-xlators-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-debuginfo-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-fuse-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-libs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-rdma-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:python2-gluster-0:3.12.2-18.el6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "glusterfs: File status information leak and denial of service"
},
{
"acknowledgments": [
{
"names": [
"Michael Hanselmann"
],
"organization": "hansmi.ch"
}
],
"cve": "CVE-2018-10928",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2018-07-30T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1612659"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in RPC request using gfs3_symlink_req in glusterfs server which allows symlink destinations to point to file paths outside of the gluster volume. An authenticated attacker could use this flaw to create arbitrary symlinks pointing anywhere on the server and execute arbitrary code on glusterfs server nodes.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glusterfs: Improper resolution of symlinks allows for privilege escalation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue did not affect Red Hat Enterprise Linux 6 and 7 as the flaw is present in glusterfs-server, which is not shipped there.\n\nThis flaw affects glusterfs versions included in Red Hat Virtualization 4 Hypervisor. However, in recommended configurations, the vulnerability is only exposed to hypervisor administrators and can not be exploited from virtual machines or other hosts on the network. For Red Hat Virtualization, Product Security has rated this flaw as Moderate. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-cli-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-client-xlators-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-debuginfo-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-events-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-fuse-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-ganesha-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-geo-replication-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-libs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-rdma-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-server-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:python2-gluster-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.noarch",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-cli-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-client-xlators-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-debuginfo-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-fuse-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-libs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-rdma-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:python2-gluster-0:3.12.2-18.el6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2018-10928"
},
{
"category": "external",
"summary": "RHBZ#1612659",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1612659"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2018-10928",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-10928"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-10928",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10928"
}
],
"release_date": "2018-09-04T05:30:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2018-09-04T06:25:24+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-cli-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-client-xlators-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-debuginfo-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-events-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-fuse-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-ganesha-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-geo-replication-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-libs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-rdma-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-server-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:python2-gluster-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.noarch",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-cli-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-client-xlators-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-debuginfo-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-fuse-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-libs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-rdma-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:python2-gluster-0:3.12.2-18.el6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2018:2608"
},
{
"category": "workaround",
"details": "To limit exposure of gluster server nodes : \n\n1. gluster server should be on LAN and not reachable from public networks. \n2. Use gluster auth.allow and auth.reject. \n3. Use TLS certificates to authenticate gluster clients.\n\ncaveat: This does not protect from attacks by authenticated gluster clients.",
"product_ids": [
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-cli-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-client-xlators-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-debuginfo-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-events-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-fuse-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-ganesha-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-geo-replication-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-libs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-rdma-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-server-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:python2-gluster-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.noarch",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-cli-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-client-xlators-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-debuginfo-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-fuse-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-libs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-rdma-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:python2-gluster-0:3.12.2-18.el6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-cli-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-client-xlators-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-debuginfo-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-events-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-fuse-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-ganesha-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-geo-replication-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-libs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-rdma-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-server-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:python2-gluster-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.noarch",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-cli-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-client-xlators-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-debuginfo-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-fuse-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-libs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-rdma-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:python2-gluster-0:3.12.2-18.el6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "glusterfs: Improper resolution of symlinks allows for privilege escalation"
},
{
"acknowledgments": [
{
"names": [
"Michael Hanselmann"
],
"organization": "hansmi.ch"
}
],
"cve": "CVE-2018-10929",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2018-07-30T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1612660"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in RPC request using gfs2_create_req in glusterfs server. An authenticated attacker could use this flaw to create arbitrary files and execute arbitrary code on glusterfs server nodes.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glusterfs: Arbitrary file creation on storage server allows for execution of arbitrary code",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue did not affect Red Hat Enterprise Linux 6 and 7 as the flaw is present in glusterfs-server, which is not shipped there.\n\nThis flaw affects glusterfs versions included in Red Hat Virtualization 4 Hypervisor. However, in recommended configurations, the vulnerability is only exposed to hypervisor administrators and can not be exploited from virtual machines or other hosts on the network. For Red Hat Virtualization, Product Security has rated this flaw as Moderate. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-cli-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-client-xlators-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-debuginfo-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-events-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-fuse-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-ganesha-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-geo-replication-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-libs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-rdma-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-server-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:python2-gluster-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.noarch",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-cli-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-client-xlators-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-debuginfo-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-fuse-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-libs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-rdma-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:python2-gluster-0:3.12.2-18.el6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2018-10929"
},
{
"category": "external",
"summary": "RHBZ#1612660",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1612660"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2018-10929",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-10929"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-10929",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10929"
}
],
"release_date": "2018-09-04T05:30:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2018-09-04T06:25:24+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-cli-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-client-xlators-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-debuginfo-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-events-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-fuse-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-ganesha-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-geo-replication-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-libs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-rdma-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-server-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:python2-gluster-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.noarch",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-cli-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-client-xlators-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-debuginfo-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-fuse-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-libs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-rdma-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:python2-gluster-0:3.12.2-18.el6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2018:2608"
},
{
"category": "workaround",
"details": "To limit exposure of gluster server nodes : \n\n1. gluster server should be on LAN and not reachable from public networks. \n2. Use gluster auth.allow and auth.reject. \n3. Use TLS certificates to authenticate gluster clients.\n\ncaveat: This does not protect from attacks by authenticated gluster clients.",
"product_ids": [
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-cli-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-client-xlators-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-debuginfo-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-events-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-fuse-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-ganesha-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-geo-replication-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-libs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-rdma-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-server-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:python2-gluster-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.noarch",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-cli-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-client-xlators-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-debuginfo-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-fuse-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-libs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-rdma-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:python2-gluster-0:3.12.2-18.el6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-cli-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-client-xlators-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-debuginfo-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-events-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-fuse-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-ganesha-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-geo-replication-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-libs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-rdma-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-server-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:python2-gluster-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.noarch",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-cli-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-client-xlators-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-debuginfo-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-fuse-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-libs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-rdma-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:python2-gluster-0:3.12.2-18.el6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "glusterfs: Arbitrary file creation on storage server allows for execution of arbitrary code"
},
{
"acknowledgments": [
{
"names": [
"Michael Hanselmann"
],
"organization": "hansmi.ch"
}
],
"cve": "CVE-2018-10930",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2018-07-30T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1612664"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in RPC request using gfs3_rename_req in glusterfs server. An authenticated attacker could use this flaw to write to a destination outside the gluster volume.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glusterfs: Files can be renamed outside volume",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue did not affect Red Hat Enterprise Linux 6 and 7 as the flaw is present in glusterfs-server, which is not shipped there.\n\nThis flaw affects glusterfs versions included in Red Hat Virtualization 4 Hypervisor. However, in recommended configurations, the vulnerability is only exposed to hypervisor administrators and can not be exploited from virtual machines or other hosts on the network. For Red Hat Virtualization, Product Security has rated this flaw as Moderate. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-cli-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-client-xlators-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-debuginfo-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-events-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-fuse-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-ganesha-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-geo-replication-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-libs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-rdma-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-server-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:python2-gluster-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.noarch",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-cli-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-client-xlators-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-debuginfo-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-fuse-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-libs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-rdma-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:python2-gluster-0:3.12.2-18.el6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2018-10930"
},
{
"category": "external",
"summary": "RHBZ#1612664",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1612664"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2018-10930",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-10930"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-10930",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10930"
}
],
"release_date": "2018-09-04T05:30:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2018-09-04T06:25:24+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-cli-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-client-xlators-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-debuginfo-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-events-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-fuse-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-ganesha-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-geo-replication-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-libs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-rdma-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-server-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:python2-gluster-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.noarch",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-cli-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-client-xlators-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-debuginfo-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-fuse-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-libs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-rdma-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:python2-gluster-0:3.12.2-18.el6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2018:2608"
},
{
"category": "workaround",
"details": "To limit exposure of gluster server nodes : \n\n1. gluster server should be on LAN and not reachable from public networks. \n2. Use gluster auth.allow and auth.reject. \n3. Use TLS certificates to authenticate gluster clients.\n\ncaveat: This does not protect from attacks by authenticated gluster clients.",
"product_ids": [
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-cli-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-client-xlators-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-debuginfo-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-events-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-fuse-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-ganesha-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-geo-replication-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-libs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-rdma-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-server-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:python2-gluster-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.noarch",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-cli-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-client-xlators-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-debuginfo-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-fuse-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-libs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-rdma-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:python2-gluster-0:3.12.2-18.el6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.0"
},
"products": [
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:glusterfs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-api-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-cli-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-client-xlators-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-debuginfo-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-devel-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-events-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-fuse-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-ganesha-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-geo-replication-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-libs-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-rdma-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:glusterfs-server-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:python2-gluster-0:3.12.2-18.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.src",
"6Server-RH-Gluster-3.4-Server:redhat-release-server-0:6Server-6.10.0.24.el6rhs.x86_64",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.noarch",
"6Server-RH-Gluster-3.4-Server:redhat-storage-server-0:3.4.0.0-1.el6rhs.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.src",
"6Server-RHSClient:glusterfs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-api-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-cli-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-client-xlators-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-debuginfo-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-devel-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-fuse-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-libs-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:glusterfs-rdma-0:3.12.2-18.el6.x86_64",
"6Server-RHSClient:python2-gluster-0:3.12.2-18.el6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "glusterfs: Files can be renamed outside volume"
}
]
}
Loading...
Loading...
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.