Description
glusterfs server before versions 3.10.12, 4.0.2 is vulnerable when using 'auth.allow' option which allows any unauthenticated gluster client to connect from any network to mount gluster storage volumes. NOTE: this vulnerability exists because of a CVE-2018-1088 regression.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | glusterfs | glusterfs 3.10.12, glusterfs 4.0.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | glusterfs +9 | 3.8.4-54.8.el7 | RHSA-2018:1269 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Gluster Storage 3 | glusterfs +9 | 3.8.4-54.8.el7 | RHSA-2018:1269, RHSA-2018:1268 |
| Red Hat Gluster Storage 3 | glusterfs-events +4 | 3.8.4-54.8.el7rhgs | RHSA-2018:1269, RHSA-2018:1268 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.1 | glusterfs | 3.12.15-lp151.3.3.1 | openSUSE-SU-2020:0079-1 |
Advisories 3
- RHSA-2018:1269 Red Hat Security Advisory: glusterfs security update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- RHSA-2018:1268 Red Hat Security Advisory: glusterfs security update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- openSUSE-SU-2020:0079-1 Security update for glusterfs SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1112
- https://review.gluster.org/#/c/19899/1..2
- https://access.redhat.com/articles/3422521
- RHSA-2018:1268 vendor-advisory
- RHSA-2018:1269 vendor-advisory
- openSUSE-SU-2020:0079 vendor-advisory