Description
It was found that the fix for CVE-2018-10927, CVE-2018-10928, CVE-2018-10929, CVE-2018-10930, and CVE-2018-10926 was incomplete. A remote, authenticated attacker could use one of these flaws to execute arbitrary code, create arbitrary files, or cause denial of service on glusterfs server nodes via symlinks to relative paths.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| [UNKNOWN] | glusterfs | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | glusterfs | 5.1-1 | — |
| Debian 13 | glusterfs | 5.1-1 | — |
| Debian 12 | glusterfs | 5.1-1 | — |
| Debian 8 | glusterfs | 3.5.2-2+deb8u5 | DLA-1565-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | glusterfs | 3.13.2-1ubuntu1+esm1 | USN-4770-1 |
| Ubuntu Pro 16.04 LTS | glusterfs | 3.7.6-1ubuntu1+esm1 | USN-4770-1 |
| Ubuntu Pro 14.04 LTS | glusterfs | 3.4.2-1ubuntu1+esm1 | USN-4770-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | glusterfs +8 | 3.12.2-25.el7 | RHSA-2018:3432 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Gluster Storage 3 | glusterfs +9 | 3.12.2-25.el6 | RHSA-2018:3432, RHSA-2018:3431 |
| Red Hat Gluster Storage 3 | glusterfs-events +3 | 3.12.2-25.el6rhs | RHSA-2018:3432, RHSA-2018:3431 |
| Red Hat Gluster Storage 3 | glusterfs-resource-agents | 3.12.2-25.el7rhgs | RHSA-2018:3432 |
| Red Hat Gluster Storage 3 | redhat-storage-server | 3.4.1.0-1.el6rhs | RHSA-2018:3432, RHSA-2018:3431 |
Advisories 4
- RHSA-2018:3431 Red Hat Security Advisory: glusterfs security and bug fix update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- RHSA-2018:3432 Red Hat Security Advisory: glusterfs security and bug fix update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- USN-4770-1 glusterfs vulnerabilities Ubuntu Security Notices (USN) · Jun 29, 2026
- DLA-1565-1 glusterfs - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14651
- RHSA-2018:3431 vendor-advisory
- [debian-lts-announce] 20181105 [SECURITY] [DLA 1565-1] glusterfs security update mailing-list
- RHSA-2018:3432 vendor-advisory
- GLSA-201904-06 vendor-advisory