Description
A flaw was found in RPC request using gfs3_symlink_req in glusterfs server which allows symlink destinations to point to file paths outside of the gluster volume. An authenticated attacker could use this flaw to create arbitrary symlinks pointing anywhere on the server and execute arbitrary code on glusterfs server nodes.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | glusterfs | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | glusterfs | 4.1.4-1 | — |
| Debian 13 | glusterfs | 4.1.4-1 | — |
| Debian 12 | glusterfs | 4.1.4-1 | — |
| Debian 9 | glusterfs | 3.8.8-1+deb9u1 | DLA-2806-1 |
| Debian 8 | glusterfs | 3.5.2-2+deb8u4 | DLA-1510-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | glusterfs | 3.13.2-1ubuntu1+esm1 | USN-4770-1 |
| Ubuntu Pro 16.04 LTS | glusterfs | 3.7.6-1ubuntu1+esm1 | USN-4770-1 |
| Ubuntu Pro 14.04 LTS | glusterfs | 3.4.2-1ubuntu1+esm1 | USN-4770-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | glusterfs +8 | 3.12.2-18.el7 | RHSA-2018:2607 |
| RHEL 7 | imgbased +1 | 1.0.29-1.el7ev | RHSA-2018:3470 |
| RHEL 7 | redhat-release-virtualization-host +1 | 4.2-7.3.el7 | RHSA-2018:3470 |
| RHEL 7 | redhat-virtualization-host +1 | 4.2-20181026.0.el7_6 | RHSA-2018:3470 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Gluster Storage 3 | glusterfs +9 | 3.12.2-18.el6 | RHSA-2018:2608, RHSA-2018:2607 |
| Red Hat Gluster Storage 3 | glusterfs-events +3 | 3.12.2-18.el6rhs | RHSA-2018:2608, RHSA-2018:2607 |
| Red Hat Gluster Storage 3 | glusterfs-resource-agents | 3.12.2-18.el7rhgs | RHSA-2018:2607 |
| Red Hat Gluster Storage 3 | redhat-release-server | 6Server-6.10.0.24.el6rhs | RHSA-2018:2608, RHSA-2018:2607 |
| Red Hat Gluster Storage 3 | redhat-storage-server | 3.4.0.0-1.el6rhs | RHSA-2018:2608, RHSA-2018:2607 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.1 | glusterfs | 3.12.15-lp151.3.3.1 | openSUSE-SU-2020:0079-1 |
Advisories 7
- RHSA-2018:2607 Red Hat Security Advisory: Red Hat Gluster Storage security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jul 25, 2026
- RHSA-2018:3470 Red Hat Security Advisory: Red Hat Virtualization security and bug fix update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- RHSA-2018:2608 Red Hat Security Advisory: Red Hat Gluster Storage security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- USN-4770-1 glusterfs vulnerabilities Ubuntu Security Notices (USN) · Jun 29, 2026
- DLA-2806-1 glusterfs - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1510-1 glusterfs - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2020:0079-1 Security update for glusterfs SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10928
- RHSA-2018:2607 vendor-advisory
- [debian-lts-announce] 20180920 [SECURITY] [DLA 1510-1] glusterfs security update mailing-list
- RHSA-2018:2608 vendor-advisory
- RHSA-2018:3470 vendor-advisory
- GLSA-201904-06 vendor-advisory
- openSUSE-SU-2020:0079 vendor-advisory
- [debian-lts-announce] 20211101 [SECURITY] [DLA 2806-1] glusterfs security update mailing-list