Description
GlusterFS 3.3.0, as used in Red Hat Storage server 2.0, allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | glusterfs | 3.2.7-5 | — |
| Debian 13 | glusterfs | 3.2.7-5 | — |
| Debian 12 | glusterfs | 3.2.7-5 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Gluster Storage 3 | glusterfs +3 | 3.3.0.5rhs-37.el6 | RHSA-2012:1456 |
| Red Hat Gluster Storage 2 | glusterfs +3 | 3.3.0.5rhs-37.el5 | RHSA-2012:1456 |
| Red Hat Gluster Storage 2 | glusterfs-server +1 | 3.3.0.5rhs-37.el6rhs | RHSA-2012:1456 |
| Red Hat Gluster Storage 2 | sos | 2.2-17.1.el6rhs | RHSA-2012:1456 |
Advisories 1
- RHSA-2012:1456 Red Hat Security Advisory: Red Hat Storage 2.0 security, bug fix, and enhancement update #3 Red Hat Security Advisories (RHSA) · Jun 28, 2026
References
- RHSA-2012:1456 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=856341
- 1027756 vdb-entry
- redhat-storage-glusterfs-symlink(80074) vdb-entry
- 56522 vdb-entry