Summary
It was discovered that GlusterFS incorrectly handled network requests. An
attacker could possibly use this issue to cause a denial of service. This issue
only affected Ubuntu 14.04 ESM. (CVE-2014-3619)
It was discovered that GlusterFS incorrectly handled user permissions. An
authenticated attacker could possibly use this to add himself to a trusted
storage pool and perform privileged operations on volumes. This issue only
affected Ubuntu 16.04 ESM and Ubuntu 18.04 ESM. (CVE-2018-10841)
It was discovered that GlusterFS incorrectly handled mounting gluster
volumes. An attacker could possibly use this issue to also mount shared
gluster volumes and escalate privileges through malicious cronjobs. This
issue only affected Ubuntu 16.04 ESM and Ubuntu 18.04 ESM. (CVE-2018-1088)
It was discovered that GlusterFS incorrectly handled file paths. An
attacker could possibly use this issue to create arbitrary files and
execute arbitrary code. (CVE-2018-10904)
It was discovered that GlusterFS incorrectly handled mounting volumes. An
attacker could possibly use this issue to cause a denial of service or run
arbitrary code. (CVE-2018-10907)
It was discovered that GlusterFS incorrectly handled negative key length
values. An attacker could possibly use this issue to obtain sensitive
information. (CVE-2018-10911)
It was discovered that GlusterFS incorrectly handled FUSE requests. An
attacker could use this issue to obtain sensitive information.
(CVE-2018-10913, CVE-2018-10914)
It was discovered that GlusterFS incorrectly handled the file creation
process. An authenticated attacker could possibly use this issue to create
arbitrary files and obtain sensitive information. (CVE-2018-10923)
It was discovered that GlusterFS incorrectly handled certain inputs. An
authenticated attacker could possibly use this issue to cause a denial of
service. This issue only affected Ubuntu 18.04 ESM. (CVE-2018-10924)
It was discovered that GlusterFS incorrectly handled RPC requests. An
attacker could possibly use this issue to write files to an arbitrary
location and execute arbitrary code. (CVE-2018-10926, CVE-2018-10927,
CVE-2018-10928, CVE-2018-10929, CVE-2018-10930)
It was discovered that the fix for CVE-2018-10926, CVE-2018-10927,
CVE-2018-10928, CVE-2018-10929, CVE-2018-10930 was incomplete. A remote
authenticated attacker could possibly use this issue to execute arbitrary
code or cause a denial of service. (CVE-2018-14651)
It was discovered that GlusterFS incorrectly handled certain files. A
remote authenticated attacker could possibly use this issue to cause a
denial of service. (CVE-2018-14652)
It was discovered that GlusterFS incorrectly handled RPC requests. A remote
authenticated attacker could possibly use this issue to cause a denial of
service or other unspecified impact. (CVE-2018-14653)
It was discovered that GlusterFS incorrectly handled mount volumes
operation. A remote attacker could possibly use this issue to create
arbitrary files. This issue only affected Ubuntu 18.04 ESM. (CVE-2018-14654)
It was discovered that GlusterFS incorrectly handled certain files. A
remote authenticated attacker could possibly use this issue to create
arbitrary files. (CVE-2018-14659)
It was discovered that GlusterFS incorrectly handled certain inputs. A
remote authenticated attacker could possibly use this is issue to cause a
denial of service. This issue only affected Ubuntu 18.04 ESM. (CVE-2018-14660)
It was discovered that GlusterFS incorrectly handled strings. A remote
authenticated attacker could possibly use this issue to cause a denial of
service. (CVE-2018-14661)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | glusterfs | 3.4.2-1ubuntu1+esm1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | glusterfs | 3.7.6-1ubuntu1+esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | glusterfs | 3.13.2-1ubuntu1+esm1 |
Vulnerabilities 22
-
High 8.8
It was found that glusterfs server does not properly sanitize file paths in the "trusted.io-stats-dump" extended attrib…
-
High 8.8
It was found that glusterfs server is vulnerable to multiple stack based buffer overflows due to functions in server-rp…
-
High 8.8
A flaw was found in RPC request using gfs3_symlink_req in glusterfs server which allows symlink destinations to point t…
-
High 8.8
A flaw was found in RPC request using gfs2_create_req in glusterfs server. An authenticated attacker could use this fla…
-
High 8.8
It was found that the fix for CVE-2018-10927, CVE-2018-10928, CVE-2018-10929, CVE-2018-10930, and CVE-2018-10926 was in…
-
High 8.1
A flaw was found in RPC request using gfs3_mknod_req supported by glusterfs server. An authenticated attacker could use…
-
High 7.6
It was found that the "mknod" call derived from mknod(2) can create files pointing to devices on a glusterfs server nod…
-
High 7.1
A flaw was found in RPC request using gfs3_lookup_req in glusterfs server. An authenticated attacker could use this fla…
-
Medium 6.6
glusterfs is vulnerable to privilege escalation on gluster server nodes. An authenticated gluster client via TLS could …
-
Medium 6.5
A flaw was found in the way dic_unserialize function of glusterfs does not handle negative key length values. An attack…
-
Medium 6.5
A flaw was found in RPC request using gfs3_rename_req in glusterfs server. An authenticated attacker could use this fla…
-
Medium 6.5
The Gluster file system through versions 3.12 and 4.1.4 is vulnerable to a buffer overflow in the 'features/index' tran…
-
Medium 6.5
The Gluster file system through versions 4.1.4 and 3.12 is vulnerable to a heap-based buffer overflow in the '__server_…
-
Medium 6.5
The Gluster file system through versions 4.1.4 and 3.1.2 is vulnerable to a denial of service attack via use of the 'GF…
-
Medium 6.5
A flaw was found in glusterfs server through versions 4.1.4 and 3.1.2 which allowed repeated usage of GF_META_LOCK_KEY …
-
Medium 6.5
It was found that usage of snprintf function in feature/locks translator of glusterfs server 3.8.4, as shipped with Red…
-
Medium 5.5
It was found that an attacker could issue a xattr request via glusterfs FUSE to cause gluster brick process to crash wh…
-
Medium 5.4
The Gluster file system through version 4.1.4 is vulnerable to abuse of the 'features/index' translator. A remote attac…
-
Medium 5.3
It was discovered that fsync(2) system call in glusterfs client code leaks memory. An authenticated attacker could use …
-
Low 3.5
An information disclosure vulnerability was discovered in glusterfs server. An attacker could issue a xattr request via…
-
Unscored —
The __socket_proto_state_machine function in GlusterFS 3.5 allows remote attackers to cause a denial of service (infini…
-
Unscored —CVE-2018-1088 Public exploit
A privilege escalation flaw was found in gluster 3.x snapshot scheduler. Any gluster client allowed to mount gluster vo…
References
-
report
https://ubuntu.com/security/CVE-2014-3619
-
report
https://ubuntu.com/security/CVE-2018-1088
-
report
https://ubuntu.com/security/CVE-2018-10841
-
report
https://ubuntu.com/security/CVE-2018-10904
-
report
https://ubuntu.com/security/CVE-2018-10907
-
report
https://ubuntu.com/security/CVE-2018-10911
-
report
https://ubuntu.com/security/CVE-2018-10913
-
report
https://ubuntu.com/security/CVE-2018-10914
-
report
https://ubuntu.com/security/CVE-2018-10923
-
report
https://ubuntu.com/security/CVE-2018-10924
-
report
https://ubuntu.com/security/CVE-2018-10926
-
report
https://ubuntu.com/security/CVE-2018-10927
-
report
https://ubuntu.com/security/CVE-2018-10928
-
report
https://ubuntu.com/security/CVE-2018-10929
-
report
https://ubuntu.com/security/CVE-2018-10930
-
report
https://ubuntu.com/security/CVE-2018-14651
-
report
https://ubuntu.com/security/CVE-2018-14652
-
report
https://ubuntu.com/security/CVE-2018-14653
-
report
https://ubuntu.com/security/CVE-2018-14654
-
report
https://ubuntu.com/security/CVE-2018-14659
-
report
https://ubuntu.com/security/CVE-2018-14660
-
report
https://ubuntu.com/security/CVE-2018-14661