Skip to content
OpenAdvisories
Medium ALAS2-2018-1128 1 CVE

Moderate: glusterfs security update (Amazon Linux 2)

Published Dec 13, 2018 · Updated Dec 19, 2018

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-10911: A flaw was found in dict.c:dict_unserialize function of glusterfs, dic_unserialize function does not handle negative key length values. An attacker could use this flaw to read memory from other locations into the stored dict value. 1601657: CVE-2018-10911 glusterfs: Improper deserialization in dict.c:dict_unserialize() can allow attackers to read arbitrary memory

Fixed packages 11

ReleasePackageFixed in
Amazon Linux · 2 glusterfs 0:3.12.2-18.amzn2
Amazon Linux · 2 glusterfs-api 0:3.12.2-18.amzn2
Amazon Linux · 2 glusterfs-api-devel 0:3.12.2-18.amzn2
Amazon Linux · 2 glusterfs-cli 0:3.12.2-18.amzn2
Amazon Linux · 2 glusterfs-client-xlators 0:3.12.2-18.amzn2
Amazon Linux · 2 glusterfs-debuginfo 0:3.12.2-18.amzn2
Amazon Linux · 2 glusterfs-devel 0:3.12.2-18.amzn2
Amazon Linux · 2 glusterfs-fuse 0:3.12.2-18.amzn2
Amazon Linux · 2 glusterfs-libs 0:3.12.2-18.amzn2
Amazon Linux · 2 glusterfs-rdma 0:3.12.2-18.amzn2
Amazon Linux · 2 python2-gluster 0:3.12.2-18.amzn2

Vulnerabilities 1

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-10911.html