Description
The Red Hat gluster-swift package, as used in Red Hat Gluster Storage (formerly Red Hat Storage Server), allows remote authenticated users to bypass the max_meta_count constraint via multiple crafted requests which exceed the limit when combined.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | glusterfs +1 | 3.7.1-16.el7 | RHSA-2015:1846 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Gluster Storage 3 | gdeploy | 1.0-12.el6rhs | RHSA-2015:1846, RHSA-2015:1845 |
| Red Hat Gluster Storage 3 | gluster-nagios-addons | 0.2.5-1.el6rhs | RHSA-2015:1846, RHSA-2015:1845 |
| Red Hat Gluster Storage 3 | glusterfs +9 | 3.7.1-16.el6 | RHSA-2015:1846, RHSA-2015:1845 |
| Red Hat Gluster Storage 3 | glusterfs-server +2 | 3.7.1-16.el6rhs | RHSA-2015:1846, RHSA-2015:1845 |
| Red Hat Gluster Storage 3 | gstatus | 0.65-1.el6rhs | RHSA-2015:1846, RHSA-2015:1845 |
| Red Hat Gluster Storage 3 | nagios-server-addons +1 | 0.2.2-1.el6rhs | RHSA-2015:1846, RHSA-2015:1845 |
| Red Hat Gluster Storage 3 | nfs-ganesha +1 | 2.2.0-9.el6rhs | RHSA-2015:1846, RHSA-2015:1845 |
| Red Hat Gluster Storage 3 | openstack-swift +5 | 1.13.1-6.el6ost | RHSA-2015:1846, RHSA-2015:1845 |
| Red Hat Gluster Storage 3 | redhat-storage-server | 3.1.1.0-2.el6rhs | RHSA-2015:1846, RHSA-2015:1845 |
| Red Hat Gluster Storage 3 | swiftonfile | 1.13.1-5.el6rhs | RHSA-2015:1846, RHSA-2015:1845 |
| Red Hat Gluster Storage 3 | vdsm +14 | 4.16.20-1.3.el6rhs | RHSA-2015:1846, RHSA-2015:1845 |
Advisories 2
- RHSA-2015:1845 Red Hat Security Advisory: Red Hat Gluster Storage 3.1 update Red Hat Security Advisories (RHSA) · Aug 8, 2026
- RHSA-2015:1846 Red Hat Security Advisory: Red Hat Gluster Storage 3.1 update Red Hat Security Advisories (RHSA) · Aug 8, 2026
References
- RHSA-2015:1845 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1257525
- RHSA-2015:1846 vendor-advisory
- [oss-security] 20150827 CVE-2014-8177 gluster-swift metadata constraints are not correctly enforced mailing-list