Red Hat Security Advisory: Red Hat Gluster Storage security, bug fix, and enhancement update

Fixed packages 28

Vulnerabilities 11

• High 8.8
  CVE-2018-10904

  It was found that glusterfs server does not properly sanitize file paths in the "trusted.io-stats-dump" extended attrib…

  Red Hat GlusterFS glusterfs glusterfs Debian Ubuntu
  Sep 4, 2018
• High 8.8
  CVE-2018-10907

  It was found that glusterfs server is vulnerable to multiple stack based buffer overflows due to functions in server-rp…

  Red Hat GlusterFS glusterfs glusterfs Debian Ubuntu
  Sep 4, 2018
• High 8.8
  CVE-2018-10928

  A flaw was found in RPC request using gfs3_symlink_req in glusterfs server which allows symlink destinations to point t…

  Red Hat GlusterFS glusterfs glusterfs Debian Ubuntu
  Sep 4, 2018
• High 8.8
  CVE-2018-10929

  A flaw was found in RPC request using gfs2_create_req in glusterfs server. An authenticated attacker could use this fla…

  Red Hat GlusterFS glusterfs glusterfs Debian Ubuntu
  Sep 4, 2018
• High 8.1
  CVE-2018-10926

  A flaw was found in RPC request using gfs3_mknod_req supported by glusterfs server. An authenticated attacker could use…

  Red Hat GlusterFS glusterfs glusterfs Debian Ubuntu
  Sep 4, 2018
• High 7.6
  CVE-2018-10923

  It was found that the "mknod" call derived from mknod(2) can create files pointing to devices on a glusterfs server nod…

  Red Hat GlusterFS glusterfs glusterfs Debian Ubuntu
  Sep 4, 2018
• High 7.1
  CVE-2018-10927

  A flaw was found in RPC request using gfs3_lookup_req in glusterfs server. An authenticated attacker could use this fla…

  Red Hat GlusterFS glusterfs glusterfs Debian Ubuntu
  Sep 4, 2018
• Medium 6.5
  CVE-2018-10911

  A flaw was found in the way dic_unserialize function of glusterfs does not handle negative key length values. An attack…

  Red Hat GlusterFS glusterfs glusterfs Debian Ubuntu
  Sep 4, 2018
• Medium 6.5
  CVE-2018-10930

  A flaw was found in RPC request using gfs3_rename_req in glusterfs server. An authenticated attacker could use this fla…

  Red Hat GlusterFS glusterfs glusterfs Debian Ubuntu
  Sep 4, 2018
• Medium 5.5
  CVE-2018-10914

  It was found that an attacker could issue a xattr request via glusterfs FUSE to cause gluster brick process to crash wh…

  Red Hat GlusterFS glusterfs glusterfs Debian Ubuntu
  Sep 4, 2018
• Low 3.5
  CVE-2018-10913

  An information disclosure vulnerability was discovered in glusterfs server. An attacker could issue a xattr request via…

  Red Hat GlusterFS glusterfs glusterfs Debian Ubuntu
  Sep 4, 2018

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/documentation/en-us/red_hat_gluster_storage/3.4/html/3.4_release_notes/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1507040
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1507042
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1508777
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1558509
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1569312
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1601298
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1601642
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1601657
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1607617
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1607618
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1610659
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1612658
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1612659
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1612660
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1612664
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1613143
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2608.json
• report
  https://access.redhat.com/security/cve/CVE-2018-10904
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-10904
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-10904
• report
  https://access.redhat.com/security/cve/CVE-2018-10907
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-10907
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-10907
• report
  https://access.redhat.com/security/cve/CVE-2018-10911
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-10911
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-10911
• report
  https://access.redhat.com/security/cve/CVE-2018-10913
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-10913
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-10913
• report
  https://access.redhat.com/security/cve/CVE-2018-10914
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-10914
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-10914
• report
  https://access.redhat.com/security/cve/CVE-2018-10923
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-10923
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-10923
• report
  https://access.redhat.com/security/cve/CVE-2018-10926
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-10926