6.6
Medium
CVE-2018-10841 glusterfs is vulnerable to privilege escalation on gluster server nodes
Description
glusterfs is vulnerable to privilege escalation on gluster server nodes. An authenticated gluster client via TLS could use gluster cli with --remote-host command to add it self to trusted storage pool and perform privileged gluster operations like adding other machines to trusted storage pool, start, stop, and delete volumes.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| glusterfs | Versions not published |
References
- bugzilla.redhat.com bugzilla.redhat.com
- RHSA-2018:1955 access.redhat.com
- review.gluster.org review.gluster.org
- RHSA-2018:1954 access.redhat.com
- GLSA-201904-06 security.gentoo.org
- [debian-lts-announce] 20211101 [SECURITY] [DLA 2806-1] glusterfs security update lists.debian.org
Timeline
- Published
- Last modified
Other CVEs of glusterfs
The 12 CVEs of glusterfs →
CVE-2018-10930
A flaw was found in RPC request using gfs3_rename_req in glusterfs server
6.5
Medium
CVE-2018-10929
A flaw was found in RPC request using gfs2_create_req in glusterfs server
8.8
High
CVE-2018-10926
A flaw was found in RPC request using gfs3_mknod_req supported by glusterfs server
8.1
High
CVE-2018-10927
A flaw was found in RPC request using gfs3_lookup_req in glusterfs server
7.1
High