RHSA-2018:2607 — Red Hat Security Advisory: Red Hat Gluster Storage security, bug fix, and enhancement update

Fixed packages 39

Release	Package	Fixed in
Red Hat · RHEL 7 enterprise_linux:7::hypervisor	glusterfs	0:3.12.2-18.el7
Red Hat · RHEL 7 enterprise_linux:7::hypervisor	glusterfs-api	0:3.12.2-18.el7
Red Hat · RHEL 7 enterprise_linux:7::hypervisor	glusterfs-api-devel	0:3.12.2-18.el7
Red Hat · RHEL 7 enterprise_linux:7::hypervisor	glusterfs-cli	0:3.12.2-18.el7
Red Hat · RHEL 7 enterprise_linux:7::hypervisor	glusterfs-client-xlators	0:3.12.2-18.el7
Red Hat · RHEL 7 enterprise_linux:7::hypervisor	glusterfs-debuginfo	0:3.12.2-18.el7
Red Hat · RHEL 7 enterprise_linux:7::hypervisor	glusterfs-devel	0:3.12.2-18.el7
Red Hat · RHEL 7 enterprise_linux:7::hypervisor	glusterfs-fuse	0:3.12.2-18.el7
Red Hat · RHEL 7 enterprise_linux:7::hypervisor	glusterfs-libs	0:3.12.2-18.el7
Red Hat · RHEL 7 enterprise_linux:7::hypervisor	glusterfs-rdma	0:3.12.2-18.el7
Red Hat · Gluster Storage 3 storage:3:client:el7	glusterfs	0:3.12.2-18.el7
Red Hat · Gluster Storage 3 storage:3:client:el7	glusterfs-api	0:3.12.2-18.el7
Red Hat · Gluster Storage 3 storage:3:client:el7	glusterfs-api-devel	0:3.12.2-18.el7
Red Hat · Gluster Storage 3 storage:3:client:el7	glusterfs-cli	0:3.12.2-18.el7
Red Hat · Gluster Storage 3 storage:3:client:el7	glusterfs-client-xlators	0:3.12.2-18.el7
Red Hat · Gluster Storage 3 storage:3:client:el7	glusterfs-debuginfo	0:3.12.2-18.el7
Red Hat · Gluster Storage 3 storage:3:client:el7	glusterfs-devel	0:3.12.2-18.el7
Red Hat · Gluster Storage 3 storage:3:client:el7	glusterfs-fuse	0:3.12.2-18.el7
Red Hat · Gluster Storage 3 storage:3:client:el7	glusterfs-libs	0:3.12.2-18.el7
Red Hat · Gluster Storage 3 storage:3:client:el7	glusterfs-rdma	0:3.12.2-18.el7
Red Hat · Gluster Storage 3 storage:3:client:el7	python2-gluster	0:3.12.2-18.el7
Red Hat · Gluster Storage 3 storage:3.4:server:el7	glusterfs	0:3.12.2-18.el7rhgs
Red Hat · Gluster Storage 3 storage:3.4:server:el7	glusterfs-api	0:3.12.2-18.el7rhgs
Red Hat · Gluster Storage 3 storage:3.4:server:el7	glusterfs-api-devel	0:3.12.2-18.el7rhgs
Red Hat · Gluster Storage 3 storage:3.4:server:el7	glusterfs-cli	0:3.12.2-18.el7rhgs
Red Hat · Gluster Storage 3 storage:3.4:server:el7	glusterfs-client-xlators	0:3.12.2-18.el7rhgs
Red Hat · Gluster Storage 3 storage:3.4:server:el7	glusterfs-debuginfo	0:3.12.2-18.el7rhgs
Red Hat · Gluster Storage 3 storage:3.4:server:el7	glusterfs-devel	0:3.12.2-18.el7rhgs
Red Hat · Gluster Storage 3 storage:3.4:server:el7	glusterfs-events	0:3.12.2-18.el7rhgs
Red Hat · Gluster Storage 3 storage:3.4:server:el7	glusterfs-fuse	0:3.12.2-18.el7rhgs
Red Hat · Gluster Storage 3 storage:3.4:server:el7	glusterfs-ganesha	0:3.12.2-18.el7rhgs
Red Hat · Gluster Storage 3 storage:3.4:server:el7	glusterfs-geo-replication	0:3.12.2-18.el7rhgs
Red Hat · Gluster Storage 3 storage:3.4:server:el7	glusterfs-libs	0:3.12.2-18.el7rhgs
Red Hat · Gluster Storage 3 storage:3.4:server:el7	glusterfs-rdma	0:3.12.2-18.el7rhgs
Red Hat · Gluster Storage 3 storage:3.4:server:el7	glusterfs-resource-agents	0:3.12.2-18.el7rhgs
Red Hat · Gluster Storage 3 storage:3.4:server:el7	glusterfs-server	0:3.12.2-18.el7rhgs
Red Hat · Gluster Storage 3 storage:3.4:server:el7	python2-gluster	0:3.12.2-18.el7rhgs
Red Hat · Gluster Storage 3 storage:3.4:server:el7	redhat-release-server	0:7.5-11.el7rhgs
Red Hat · Gluster Storage 3 storage:3.4:server:el7	redhat-storage-server	0:3.4.0.0-1.el7rhgs

Vulnerabilities 11

High 8.8

CVE-2018-10904

It was found that glusterfs server does not properly sanitize file paths in the "trusted.io-stats-dump" extended attrib…

Red Hat GlusterFS glusterfs glusterfs Debian Ubuntu

Sep 4, 2018
High 8.8

CVE-2018-10907

It was found that glusterfs server is vulnerable to multiple stack based buffer overflows due to functions in server-rp…

Red Hat GlusterFS glusterfs glusterfs Debian Ubuntu

Sep 4, 2018
High 8.8

CVE-2018-10928

A flaw was found in RPC request using gfs3_symlink_req in glusterfs server which allows symlink destinations to point t…

Red Hat GlusterFS glusterfs glusterfs Debian Ubuntu

Sep 4, 2018
High 8.8

CVE-2018-10929

A flaw was found in RPC request using gfs2_create_req in glusterfs server. An authenticated attacker could use this fla…

Red Hat GlusterFS glusterfs glusterfs Debian Ubuntu

Sep 4, 2018
High 8.1

CVE-2018-10926

A flaw was found in RPC request using gfs3_mknod_req supported by glusterfs server. An authenticated attacker could use…

Red Hat GlusterFS glusterfs glusterfs Debian Ubuntu

Sep 4, 2018
High 7.6

CVE-2018-10923

It was found that the "mknod" call derived from mknod(2) can create files pointing to devices on a glusterfs server nod…

Red Hat GlusterFS glusterfs glusterfs Debian Ubuntu

Sep 4, 2018
High 7.1

CVE-2018-10927

A flaw was found in RPC request using gfs3_lookup_req in glusterfs server. An authenticated attacker could use this fla…

Red Hat GlusterFS glusterfs glusterfs Debian Ubuntu

Sep 4, 2018
Medium 6.5

CVE-2018-10911

A flaw was found in the way dic_unserialize function of glusterfs does not handle negative key length values. An attack…

Red Hat GlusterFS glusterfs glusterfs Debian Ubuntu

Sep 4, 2018
Medium 6.5

CVE-2018-10930

A flaw was found in RPC request using gfs3_rename_req in glusterfs server. An authenticated attacker could use this fla…

Red Hat GlusterFS glusterfs glusterfs Debian Ubuntu

Sep 4, 2018
Medium 5.5

CVE-2018-10914

It was found that an attacker could issue a xattr request via glusterfs FUSE to cause gluster brick process to crash wh…

Red Hat GlusterFS glusterfs glusterfs Debian Ubuntu

Sep 4, 2018
Low 3.5

CVE-2018-10913

An information disclosure vulnerability was discovered in glusterfs server. An attacker could issue a xattr request via…

Red Hat GlusterFS glusterfs glusterfs Debian Ubuntu

Sep 4, 2018

References

article
https://access.redhat.com/security/updates/classification/#important
article
https://access.redhat.com/site/documentation/en-US/red_hat_gluster_storage/3.4/html/3.4_release_notes/
report
https://bugzilla.redhat.com/show_bug.cgi?id=1118770
report
https://bugzilla.redhat.com/show_bug.cgi?id=1167789
report
https://bugzilla.redhat.com/show_bug.cgi?id=1186664
report
https://bugzilla.redhat.com/show_bug.cgi?id=1215556
report
https://bugzilla.redhat.com/show_bug.cgi?id=1226874
report
https://bugzilla.redhat.com/show_bug.cgi?id=1234884
report
https://bugzilla.redhat.com/show_bug.cgi?id=1260479
report
https://bugzilla.redhat.com/show_bug.cgi?id=1262230
report
https://bugzilla.redhat.com/show_bug.cgi?id=1277924
report
https://bugzilla.redhat.com/show_bug.cgi?id=1282318
report
https://bugzilla.redhat.com/show_bug.cgi?id=1282731
report
https://bugzilla.redhat.com/show_bug.cgi?id=1283045
report
https://bugzilla.redhat.com/show_bug.cgi?id=1286092
report
https://bugzilla.redhat.com/show_bug.cgi?id=1286820
report
https://bugzilla.redhat.com/show_bug.cgi?id=1288115
report
https://bugzilla.redhat.com/show_bug.cgi?id=1293332
report
https://bugzilla.redhat.com/show_bug.cgi?id=1293349
report
https://bugzilla.redhat.com/show_bug.cgi?id=1294412
report
https://bugzilla.redhat.com/show_bug.cgi?id=1299740
report
https://bugzilla.redhat.com/show_bug.cgi?id=1301474
report
https://bugzilla.redhat.com/show_bug.cgi?id=1319271
report
https://bugzilla.redhat.com/show_bug.cgi?id=1324531
report
https://bugzilla.redhat.com/show_bug.cgi?id=1330526
report
https://bugzilla.redhat.com/show_bug.cgi?id=1333705
report
https://bugzilla.redhat.com/show_bug.cgi?id=1338693
report
https://bugzilla.redhat.com/show_bug.cgi?id=1339054
report
https://bugzilla.redhat.com/show_bug.cgi?id=1339765
report
https://bugzilla.redhat.com/show_bug.cgi?id=1341190
report
https://bugzilla.redhat.com/show_bug.cgi?id=1342785
report
https://bugzilla.redhat.com/show_bug.cgi?id=1345828
report
https://bugzilla.redhat.com/show_bug.cgi?id=1356454
report
https://bugzilla.redhat.com/show_bug.cgi?id=1360331
report
https://bugzilla.redhat.com/show_bug.cgi?id=1361209
report
https://bugzilla.redhat.com/show_bug.cgi?id=1369312
report
https://bugzilla.redhat.com/show_bug.cgi?id=1369420
report
https://bugzilla.redhat.com/show_bug.cgi?id=1375094
report
https://bugzilla.redhat.com/show_bug.cgi?id=1378371

Red Hat Security Advisory: Red Hat Gluster Storage security, bug fix, and enhancement update

Fixed packages 39

Vulnerabilities 11

It was found that glusterfs server does not properly sanitize file paths in the "trusted.io-stats-dump" extended attrib…

It was found that glusterfs server is vulnerable to multiple stack based buffer overflows due to functions in server-rp…

A flaw was found in RPC request using gfs3_symlink_req in glusterfs server which allows symlink destinations to point t…

A flaw was found in RPC request using gfs2_create_req in glusterfs server. An authenticated attacker could use this fla…

A flaw was found in RPC request using gfs3_mknod_req supported by glusterfs server. An authenticated attacker could use…

It was found that the "mknod" call derived from mknod(2) can create files pointing to devices on a glusterfs server nod…

A flaw was found in RPC request using gfs3_lookup_req in glusterfs server. An authenticated attacker could use this fla…

A flaw was found in the way dic_unserialize function of glusterfs does not handle negative key length values. An attack…

A flaw was found in RPC request using gfs3_rename_req in glusterfs server. An authenticated attacker could use this fla…

It was found that an attacker could issue a xattr request via glusterfs FUSE to cause gluster brick process to crash wh…

An information disclosure vulnerability was discovered in glusterfs server. An attacker could issue a xattr request via…

References