Red Hat Glusterfs
14 CVEs affecting Red Hat Glusterfs. Latest disclosed: 2018-09-04. Critical: 0, High: 9.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-10929 | High | 8.8 | 2018-09-04 | A flaw was found in RPC request using gfs2_create_req in glusterfs server. An authenticated attacker could use this flaw to create arbitrary files and execute… |
CVE-2018-10928 | High | 8.8 | 2018-09-04 | A flaw was found in RPC request using gfs3_symlink_req in glusterfs server which allows symlink destinations to point to file paths outside of the gluster volu… |
CVE-2018-10926 | High | 8.8 | 2018-09-04 | A flaw was found in RPC request using gfs3_mknod_req supported by glusterfs server. An authenticated attacker could use this flaw to write files to an arbitrar… |
CVE-2018-10907 | High | 8.8 | 2018-09-04 | It was found that glusterfs server is vulnerable to multiple stack based buffer overflows due to functions in server-rpc-fopc.c allocating fixed size buffers u… |
CVE-2018-10904 | High | 8.8 | 2018-09-04 | It was found that glusterfs server does not properly sanitize file paths in the "trusted.io-stats-dump" extended attribute which is used by the "debug/io-stats… |
CVE-2018-10841 | High | 8.8 | 2018-06-20 | glusterfs is vulnerable to privilege escalation on gluster server nodes. An authenticated gluster client via TLS could use gluster cli with --remote-host comma… |
CVE-2018-10927 | High | 8.1 | 2018-09-04 | A flaw was found in RPC request using gfs3_lookup_req in glusterfs server. An authenticated attacker could use this flaw to leak information and execute remote… |
CVE-2018-10923 | High | 8.1 | 2018-09-04 | It was found that the "mknod" call derived from mknod(2) can create files pointing to devices on a glusterfs server node. An authenticated attacker could use t… |
CVE-2018-1088 | High | 8.1 | 2018-04-18 | A privilege escalation flaw was found in gluster 3.x snapshot scheduler. Any gluster client allowed to mount gluster volumes could also mount shared gluster st… |
CVE-2018-10930 | Medium | 6.5 | 2018-09-04 | A flaw was found in RPC request using gfs3_rename_req in glusterfs server. An authenticated attacker could use this flaw to write to a destination outside the… |
CVE-2018-10914 | Medium | 6.5 | 2018-09-04 | It was found that an attacker could issue a xattr request via glusterfs FUSE to cause gluster brick process to crash which will result in a remote denial of se… |
CVE-2018-10913 | Medium | 6.5 | 2018-09-04 | An information disclosure vulnerability was discovered in glusterfs server. An attacker could issue a xattr request via glusterfs FUSE to determine the existen… |
CVE-2018-10924 | Medium | 5.3 | 2018-09-04 | It was discovered that fsync(2) system call in glusterfs client code leaks memory. An authenticated attacker could use this flaw to launch a denial of service… |
CVE-2017-15096 | Low | 3.3 | 2017-10-26 | A flaw was found in GlusterFS in versions prior to 3.10. A null pointer dereference in send_brick_req function in glusterfsd/src/gf_attach.c may be used to cau… |