ID CVE-2018-10911
Summary A flaw was found in the way dic_unserialize function of glusterfs does not handle negative key length values. An attacker could use this flaw to read memory from other locations into the stored dict value.
References
Vulnerable Configurations
  • Red Hat Virtualization Host 4.0
    cpe:2.3:a:redhat:virtualization_host:4.0
  • Red Hat Enterprise Linux Desktop 6.0
    cpe:2.3:o:redhat:enterprise_linux_desktop:6.0
  • RedHat Enterprise Linux Desktop 7.0
    cpe:2.3:o:redhat:enterprise_linux_desktop:7.0
  • Red Hat Enterprise Linux Server 6.0
    cpe:2.3:o:redhat:enterprise_linux_server:6.0
  • RedHat Enterprise Linux Server 7.0
    cpe:2.3:o:redhat:enterprise_linux_server:7.0
  • Red Hat Enterprise Linux Workstation 6.0
    cpe:2.3:o:redhat:enterprise_linux_workstation:6.0
  • RedHat Enterprise Linux Workstation 7.0
    cpe:2.3:o:redhat:enterprise_linux_workstation:7.0
  • Red Hat Virtualization 4.0
    cpe:2.3:o:redhat:virtualization:4.0
  • Debian Linux 8.0 (Jessie)
    cpe:2.3:o:debian:debian_linux:8.0
CVSS
Base: 5.0
Impact:
Exploitability:
CWE CWE-502
CAPEC
nessus via4
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2018-2892.NASL
    description An update for glusterfs is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. GlusterFS is a key building block of Red Hat Gluster Storage. It is based on a stackable user-space design and can deliver exceptional performance for diverse workloads. GlusterFS aggregates various storage servers over network interconnections into one large, parallel network file system. The glusterfs packages have been upgraded to upstream version 3.12.2, which provides a number of bug fixes over the previous version. (BZ#1594203) Security Fix(es) : * glusterfs: Improper deserialization in dict.c:dict_unserialize() can allow attackers to read arbitrary memory (CVE-2018-10911) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank Michael Hanselmann (hansmi.ch) for reporting this issue.
    last seen 2019-02-21
    modified 2018-11-26
    plugin id 118029
    published 2018-10-10
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=118029
    title RHEL 6 : glusterfs (RHSA-2018:2892)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2018-3470.NASL
    description An update for imgbased, redhat-release-virtualization-host, and redhat-virtualization-host is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and performing administrative tasks. Security Fix(es) : * spice: Missing check in demarshal.py:write_validate_array_item() allows for buffer overflow and denial of service (CVE-2018-10873) * glusterfs: Multiple flaws (CVE-2018-10904, CVE-2018-10907, CVE-2018-10923, CVE-2018-10926, CVE-2018-10927, CVE-2018-10928, CVE-2018-10929, CVE-2018-10930, CVE-2018-10911, CVE-2018-10914, CVE-2018-14652, CVE-2018-14653, CVE-2018-14654, CVE-2018-14659, CVE-2018-14660, CVE-2018-14661, CVE-2018-10913) * samba: Insufficient input validation in libsmbclient (CVE-2018-10858) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank Michael Hanselmann (hansmi.ch) for reporting CVE-2018-10904, CVE-2018-10907, CVE-2018-10923, CVE-2018-10926, CVE-2018-10927, CVE-2018-10928, CVE-2018-10929, CVE-2018-10930, CVE-2018-10911, CVE-2018-10914, CVE-2018-14652, CVE-2018-14653, CVE-2018-14654, CVE-2018-14659, CVE-2018-14660, CVE-2018-14661, and CVE-2018-10913. The CVE-2018-10873 issue was discovered by Frediano Ziglio (Red Hat). Bug Fix(es) : * When upgrading Red Hat Virtualization Host (RHVH), imgbased fails to run garbage collection on previous layers, so new logical volumes are removed, and the boot entry points to a logical volume that was removed. If the RHVH upgrade finishes successfully, the hypervisor boots successfully, even if garbage collection fails. (BZ#1632058) * During the upgrade process, when lvremove runs garbage collection, it prompts for user confirmation, causing the upgrade process to fail. Now the process uses 'lvremove --force' when trying to remove logical volumes and does not fail even if garbage collection fails, and as a result, the upgrade process finishes successfully. (BZ#1632585)
    last seen 2019-02-21
    modified 2019-01-02
    plugin id 118790
    published 2018-11-07
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=118790
    title RHEL 7 : Virtualization Manager (RHSA-2018:3470)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2018-2892.NASL
    description From Red Hat Security Advisory 2018:2892 : An update for glusterfs is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. GlusterFS is a key building block of Red Hat Gluster Storage. It is based on a stackable user-space design and can deliver exceptional performance for diverse workloads. GlusterFS aggregates various storage servers over network interconnections into one large, parallel network file system. The glusterfs packages have been upgraded to upstream version 3.12.2, which provides a number of bug fixes over the previous version. (BZ#1594203) Security Fix(es) : * glusterfs: Improper deserialization in dict.c:dict_unserialize() can allow attackers to read arbitrary memory (CVE-2018-10911) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank Michael Hanselmann (hansmi.ch) for reporting this issue.
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 118026
    published 2018-10-10
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=118026
    title Oracle Linux 6 : glusterfs (ELSA-2018-2892)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2018-2607.NASL
    description Updated glusterfs packages that fix multiple security issues and bugs, and add various enhancements are now available for Red Hat Gluster Storage 3.4 on Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. GlusterFS is a key building block of Red Hat Gluster Storage. It is based on a stackable user-space design and can deliver exceptional performance for diverse workloads. GlusterFS aggregates various storage servers over network interconnections into one large, parallel network file system. Security Fix(es) : * glusterfs: Unsanitized file names in debug/io-stats translator can allow remote attackers to execute arbitrary code (CVE-2018-10904) * glusterfs: Stack-based buffer overflow in server-rpc-fops.c allows remote attackers to execute arbitrary code (CVE-2018-10907) * glusterfs: I/O to arbitrary devices on storage server (CVE-2018-10923) * glusterfs: Device files can be created in arbitrary locations (CVE-2018-10926) * glusterfs: File status information leak and denial of service (CVE-2018-10927) * glusterfs: Improper resolution of symlinks allows for privilege escalation (CVE-2018-10928) * glusterfs: Arbitrary file creation on storage server allows for execution of arbitrary code (CVE-2018-10929) * glusterfs: Files can be renamed outside volume (CVE-2018-10930) * glusterfs: Improper deserialization in dict.c:dict_unserialize() can allow attackers to read arbitrary memory (CVE-2018-10911) * glusterfs: remote denial of service of gluster volumes via posix_get_file_contents function in posix-helpers.c (CVE-2018-10914) * glusterfs: Information Exposure in posix_get_file_contents function in posix-helpers.c (CVE-2018-10913) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank Michael Hanselmann (hansmi.ch) for reporting these issues. Additional Changes : These updated glusterfs packages include numerous bug fixes and enhancements. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Gluster Storage 3.4 Release Notes for information on the most significant of these changes : https://access.redhat.com/site/documentation/en-US/red_hat_gluster_sto rage/3.4/ html/3.4_release_notes/ All users of Red Hat Gluster Storage are advised to upgrade to these updated packages, which provide numerous bug fixes and enhancements.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 117317
    published 2018-09-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=117317
    title RHEL 7 : Gluster Storage (RHSA-2018:2607)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2018-9A4D7EC61E.NASL
    description 3.12.14 GA Security Fix for CVE-2018-10904 Security Fix for CVE-2018-10907 Security Fix for CVE-2018-10911 Security Fix for CVE-2018-10913 Security Fix for CVE-2018-10914 Security Fix for CVE-2018-10923 Security Fix for CVE-2018-10926 Security Fix for CVE-2018-10927 Security Fix for CVE-2018-10928 Security Fix for CVE-2018-10929 Security Fix for CVE-2018-10930 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-10-24
    plugin id 117841
    published 2018-10-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=117841
    title Fedora 27 : glusterfs (2018-9a4d7ec61e)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2018-4E660226E7.NASL
    description 4.1.4 GA Security Fix for CVE-2018-10904 Security Fix for CVE-2018-10907 Security Fix for CVE-2018-10911 Security Fix for CVE-2018-10913 Security Fix for CVE-2018-10914 Security Fix for CVE-2018-10923 Security Fix for CVE-2018-10926 Security Fix for CVE-2018-10927 Security Fix for CVE-2018-10928 Security Fix for CVE-2018-10929 Security Fix for CVE-2018-10930 ---- missing /run/gluster/metrics, see bz#1624006 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2019-01-03
    plugin id 120410
    published 2019-01-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=120410
    title Fedora 28 : glusterfs (2018-4e660226e7)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2018-A54270A213.NASL
    description 4.1.5 GA ---- 4.1.4 GA Security Fix for CVE-2018-10904 Security Fix for CVE-2018-10907 Security Fix for CVE-2018-10911 Security Fix for CVE-2018-10913 Security Fix for CVE-2018-10914 Security Fix for CVE-2018-10923 Security Fix for CVE-2018-10926 Security Fix for CVE-2018-10927 Security Fix for CVE-2018-10928 Security Fix for CVE-2018-10929 Security Fix for CVE-2018-10930 ---- missing /run/gluster/metrics, see bz#1624006 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2019-01-03
    plugin id 120672
    published 2019-01-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=120672
    title Fedora 29 : glusterfs (2018-a54270a213)
  • NASL family Huawei Local Security Checks
    NASL id EULEROS_SA-2018-1441.NASL
    description According to the version of the glusterfs packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - glusterfs: Improper deserialization in dict.c:dict_unserialize() can allow attackers to read arbitrary memory (CVE-2018-10911) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-28
    plugin id 119930
    published 2018-12-28
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=119930
    title EulerOS 2.0 SP2 : glusterfs (EulerOS-SA-2018-1441)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20181009_GLUSTERFS_ON_SL6_X.NASL
    description The glusterfs packages have been upgraded to upstream version 3.12.2, which provides a number of bug fixes over the previous version. Security Fix(es) : - glusterfs: Improper deserialization in dict.c:dict_unserialize() can allow attackers to read arbitrary memory (CVE-2018-10911)
    last seen 2019-02-21
    modified 2018-12-27
    plugin id 118056
    published 2018-10-11
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=118056
    title Scientific Linux Security Update : glusterfs on SL6.x x86_64
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2018-2608.NASL
    description Updated glusterfs packages that fix multiple security issues, several bugs, and adds various enhancements are now available for Red Hat Gluster Storage 3.4 on Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. GlusterFS is a key building block of Red Hat Gluster Storage. It is based on a stackable user-space design and can deliver exceptional performance for diverse workloads. GlusterFS aggregates various storage servers over network interconnections into one large, parallel network file system. Security Fix(es) : * glusterfs: Unsanitized file names in debug/io-stats translator can allow remote attackers to execute arbitrary code (CVE-2018-10904) * glusterfs: Stack-based buffer overflow in server-rpc-fops.c allows remote attackers to execute arbitrary code (CVE-2018-10907) * glusterfs: I/O to arbitrary devices on storage server (CVE-2018-10923) * glusterfs: Device files can be created in arbitrary locations (CVE-2018-10926) * glusterfs: File status information leak and denial of service (CVE-2018-10927) * glusterfs: Improper resolution of symlinks allows for privilege escalation (CVE-2018-10928) * glusterfs: Arbitrary file creation on storage server allows for execution of arbitrary code (CVE-2018-10929) * glusterfs: Files can be renamed outside volume (CVE-2018-10930) * glusterfs: Improper deserialization in dict.c:dict_unserialize() can allow attackers to read arbitrary memory (CVE-2018-10911) * glusterfs: remote denial of service of gluster volumes via posix_get_file_contents function in posix-helpers.c (CVE-2018-10914) * glusterfs: Information Exposure in posix_get_file_contents function in posix-helpers.c (CVE-2018-10913) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank Michael Hanselmann (hansmi.ch) for reporting these issues. Additional changes : These updated Red Hat Gluster Storage packages include numerous bug fixes and enhancements. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Gluster Storage 3.4 Release Notes for information on the most significant of these changes : https://access.redhat.com/documentation/en-us/red_hat_gluster_storage/ 3.4/html/ 3.4_release_notes/ All users of Red Hat Gluster Storage are advised to upgrade to these updated packages, which provide numerous bug fixes and enhancements. Disabled on 2018/11/06. Detection of Gluster Storage Server on RHEL 6 is no longer possible due to changes in Gluster package versioning.
    last seen 2019-02-21
    modified 2018-11-07
    plugin id 117318
    published 2018-09-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=117318
    title RHEL 6 : Gluster Storage (RHSA-2018:2608) (deprecated)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2018-2892.NASL
    description An update for glusterfs is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. GlusterFS is a key building block of Red Hat Gluster Storage. It is based on a stackable user-space design and can deliver exceptional performance for diverse workloads. GlusterFS aggregates various storage servers over network interconnections into one large, parallel network file system. The glusterfs packages have been upgraded to upstream version 3.12.2, which provides a number of bug fixes over the previous version. (BZ#1594203) Security Fix(es) : * glusterfs: Improper deserialization in dict.c:dict_unserialize() can allow attackers to read arbitrary memory (CVE-2018-10911) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank Michael Hanselmann (hansmi.ch) for reporting this issue.
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 118021
    published 2018-10-10
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=118021
    title CentOS 6 : glusterfs (CESA-2018:2892)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2018-2607.NASL
    description Updated glusterfs packages that fix multiple security issues and bugs, and add various enhancements are now available for Red Hat Gluster Storage 3.4 on Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. GlusterFS is a key building block of Red Hat Gluster Storage. It is based on a stackable user-space design and can deliver exceptional performance for diverse workloads. GlusterFS aggregates various storage servers over network interconnections into one large, parallel network file system. Security Fix(es) : * glusterfs: Unsanitized file names in debug/io-stats translator can allow remote attackers to execute arbitrary code (CVE-2018-10904) * glusterfs: Stack-based buffer overflow in server-rpc-fops.c allows remote attackers to execute arbitrary code (CVE-2018-10907) * glusterfs: I/O to arbitrary devices on storage server (CVE-2018-10923) * glusterfs: Device files can be created in arbitrary locations (CVE-2018-10926) * glusterfs: File status information leak and denial of service (CVE-2018-10927) * glusterfs: Improper resolution of symlinks allows for privilege escalation (CVE-2018-10928) * glusterfs: Arbitrary file creation on storage server allows for execution of arbitrary code (CVE-2018-10929) * glusterfs: Files can be renamed outside volume (CVE-2018-10930) * glusterfs: Improper deserialization in dict.c:dict_unserialize() can allow attackers to read arbitrary memory (CVE-2018-10911) * glusterfs: remote denial of service of gluster volumes via posix_get_file_contents function in posix-helpers.c (CVE-2018-10914) * glusterfs: Information Exposure in posix_get_file_contents function in posix-helpers.c (CVE-2018-10913) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank Michael Hanselmann (hansmi.ch) for reporting these issues. Additional Changes : These updated glusterfs packages include numerous bug fixes and enhancements. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Gluster Storage 3.4 Release Notes for information on the most significant of these changes : https://access.redhat.com/site/documentation/en-US/red_hat_gluster_sto rage/3.4/ html/3.4_release_notes/ All users of Red Hat Gluster Storage are advised to upgrade to these updated packages, which provide numerous bug fixes and enhancements.
    last seen 2019-02-21
    modified 2018-11-16
    plugin id 118982
    published 2018-11-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=118982
    title CentOS 7 : glusterfs (CESA-2018:2607)
  • NASL family Huawei Local Security Checks
    NASL id EULEROS_SA-2018-1442.NASL
    description According to the version of the glusterfs packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - glusterfs: Improper deserialization in dict.c:dict_unserialize() can allow attackers to read arbitrary memory (CVE-2018-10911) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-28
    plugin id 119931
    published 2018-12-28
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=119931
    title EulerOS 2.0 SP3 : glusterfs (EulerOS-SA-2018-1442)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DLA-1510.NASL
    description Multiple security vulnerabilities were discovered in GlusterFS, a clustered file system. Buffer overflows and path traversal issues may lead to information disclosure, denial of service or the execution of arbitrary code. To resolve the security vulnerabilities the following limitations were made in GlusterFS : - open,read,write on special files like char and block are no longer permitted - io-stat xlator can dump stat info only to /run/gluster directory For Debian 8 'Jessie', these problems have been fixed in version 3.5.2-2+deb8u4. We recommend that you upgrade your glusterfs packages. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-10-24
    plugin id 117618
    published 2018-09-21
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=117618
    title Debian DLA-1510-1 : glusterfs security update
  • NASL family Virtuozzo Local Security Checks
    NASL id VIRTUOZZO_VZLSA-2018-2892.NASL
    description An update for glusterfs is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. GlusterFS is a key building block of Red Hat Gluster Storage. It is based on a stackable user-space design and can deliver exceptional performance for diverse workloads. GlusterFS aggregates various storage servers over network interconnections into one large, parallel network file system. The glusterfs packages have been upgraded to upstream version 3.12.2, which provides a number of bug fixes over the previous version. (BZ#1594203) Security Fix(es) : * glusterfs: Improper deserialization in dict.c:dict_unserialize() can allow attackers to read arbitrary memory (CVE-2018-10911) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank Michael Hanselmann (hansmi.ch) for reporting this issue. Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-21
    plugin id 119085
    published 2018-11-21
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=119085
    title Virtuozzo 6 : glusterfs / glusterfs-api / glusterfs-api-devel / etc (VZLSA-2018-2892)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2018-3242.NASL
    description An update for glusterfs is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. GlusterFS is a key building block of Red Hat Gluster Storage. It is based on a stackable user-space design and can deliver exceptional performance for diverse workloads. GlusterFS aggregates various storage servers over network interconnections into one large, parallel network file system. The following packages have been upgraded to a later upstream version: glusterfs (3.12.2). (BZ#1579734) Security Fix(es) : * glusterfs: Improper deserialization in dict.c:dict_unserialize() can allow attackers to read arbitrary memory (CVE-2018-10911) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank Michael Hanselmann (hansmi.ch) for reporting this issue. Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes linked from the References section.
    last seen 2019-02-21
    modified 2018-11-26
    plugin id 118536
    published 2018-10-31
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=118536
    title RHEL 7 : glusterfs (RHSA-2018:3242)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2018-3242.NASL
    description From Red Hat Security Advisory 2018:3242 : An update for glusterfs is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. GlusterFS is a key building block of Red Hat Gluster Storage. It is based on a stackable user-space design and can deliver exceptional performance for diverse workloads. GlusterFS aggregates various storage servers over network interconnections into one large, parallel network file system. The following packages have been upgraded to a later upstream version: glusterfs (3.12.2). (BZ#1579734) Security Fix(es) : * glusterfs: Improper deserialization in dict.c:dict_unserialize() can allow attackers to read arbitrary memory (CVE-2018-10911) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank Michael Hanselmann (hansmi.ch) for reporting this issue. Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes linked from the References section.
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 118779
    published 2018-11-07
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=118779
    title Oracle Linux 7 : glusterfs (ELSA-2018-3242)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20181030_GLUSTERFS_ON_SL7_X.NASL
    description Security Fix(es) : - glusterfs: Improper deserialization in dict.c:dict_unserialize() can allow attackers to read arbitrary memory (CVE-2018-10911)
    last seen 2019-02-21
    modified 2018-12-27
    plugin id 119183
    published 2018-11-27
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=119183
    title Scientific Linux Security Update : glusterfs on SL7.x x86_64
  • NASL family Amazon Linux Local Security Checks
    NASL id AL2_ALAS-2018-1128.NASL
    description A flaw was found in dict.c:dict_unserialize function of glusterfs, dic_unserialize function does not handle negative key length values. An attacker could use this flaw to read memory from other locations into the stored dict value.(CVE-2018-10911)
    last seen 2019-02-21
    modified 2018-12-20
    plugin id 119783
    published 2018-12-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=119783
    title Amazon Linux 2 : glusterfs (ALAS-2018-1128)
  • NASL family Junos Local Security Checks
    NASL id JUNIPER_SPACE_JSA10917_184R1.NASL
    description According to its self-reported version number, the remote Junos Space version is 18.4.x prior to 18.4R1. It is, therefore, affected by multiple vulnerabilities : - An integer overflow issue exists in procps-ng. This is related to CVE-2018-1124. (CVE-2018-1126) - A directory traversal issue exits in reposync, a part of yum-utils.tory configuration files. If an attacker controls a repository, they may be able to copy files outside of the destination directory on the targeted system via path traversal. (CVE-2018-10897) - An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to SUID binary could use this flaw to escalate their privileges on the system. (CVE-2018-14634) Additionally, Junos Space is affected by several other vulnerabilities exist as noted in the vendor advisory. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
    last seen 2019-02-21
    modified 2019-01-10
    plugin id 121068
    published 2019-01-10
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=121068
    title Juniper Junos Space 18.4.x < 18.4R1 Multiple Vulnerabilities (JSA10917)
redhat via4
advisories
  • bugzilla
    id 1601657
    title CVE-2018-10911 glusterfs: Improper deserialization in dict.c:dict_unserialize() can allow attackers to read arbitrary memory
    oval
    AND
    • OR
      • comment Red Hat Enterprise Linux 6 Client is installed
        oval oval:com.redhat.rhsa:tst:20100842001
      • comment Red Hat Enterprise Linux 6 Server is installed
        oval oval:com.redhat.rhsa:tst:20100842002
      • comment Red Hat Enterprise Linux 6 Workstation is installed
        oval oval:com.redhat.rhsa:tst:20100842003
      • comment Red Hat Enterprise Linux 6 ComputeNode is installed
        oval oval:com.redhat.rhsa:tst:20100842004
    • OR
      • AND
        • comment glusterfs is earlier than 0:3.12.2-18.el6
          oval oval:com.redhat.rhsa:tst:20182892021
        • comment glusterfs is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20182892022
      • AND
        • comment glusterfs-api is earlier than 0:3.12.2-18.el6
          oval oval:com.redhat.rhsa:tst:20182892011
        • comment glusterfs-api is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20182892012
      • AND
        • comment glusterfs-api-devel is earlier than 0:3.12.2-18.el6
          oval oval:com.redhat.rhsa:tst:20182892017
        • comment glusterfs-api-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20182892018
      • AND
        • comment glusterfs-cli is earlier than 0:3.12.2-18.el6
          oval oval:com.redhat.rhsa:tst:20182892009
        • comment glusterfs-cli is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20182892010
      • AND
        • comment glusterfs-client-xlators is earlier than 0:3.12.2-18.el6
          oval oval:com.redhat.rhsa:tst:20182892019
        • comment glusterfs-client-xlators is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20182892020
      • AND
        • comment glusterfs-devel is earlier than 0:3.12.2-18.el6
          oval oval:com.redhat.rhsa:tst:20182892007
        • comment glusterfs-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20182892008
      • AND
        • comment glusterfs-fuse is earlier than 0:3.12.2-18.el6
          oval oval:com.redhat.rhsa:tst:20182892013
        • comment glusterfs-fuse is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20182892014
      • AND
        • comment glusterfs-libs is earlier than 0:3.12.2-18.el6
          oval oval:com.redhat.rhsa:tst:20182892005
        • comment glusterfs-libs is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20182892006
      • AND
        • comment glusterfs-rdma is earlier than 0:3.12.2-18.el6
          oval oval:com.redhat.rhsa:tst:20182892015
        • comment glusterfs-rdma is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20182892016
    rhsa
    id RHSA-2018:2892
    released 2018-10-09
    severity Moderate
    title RHSA-2018:2892: glusterfs security, bug fix, and enhancement update (Moderate)
  • bugzilla
    id 1601657
    title CVE-2018-10911 glusterfs: Improper deserialization in dict.c:dict_unserialize() can allow attackers to read arbitrary memory
    oval
    AND
    • OR
      • comment Red Hat Enterprise Linux 7 Client is installed
        oval oval:com.redhat.rhsa:tst:20140675001
      • comment Red Hat Enterprise Linux 7 Server is installed
        oval oval:com.redhat.rhsa:tst:20140675002
      • comment Red Hat Enterprise Linux 7 Workstation is installed
        oval oval:com.redhat.rhsa:tst:20140675003
      • comment Red Hat Enterprise Linux 7 ComputeNode is installed
        oval oval:com.redhat.rhsa:tst:20140675004
    • OR
      • AND
        • comment glusterfs is earlier than 0:3.12.2-18.el7
          oval oval:com.redhat.rhsa:tst:20183242017
        • comment glusterfs is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20182892022
      • AND
        • comment glusterfs-api is earlier than 0:3.12.2-18.el7
          oval oval:com.redhat.rhsa:tst:20183242013
        • comment glusterfs-api is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20182892012
      • AND
        • comment glusterfs-api-devel is earlier than 0:3.12.2-18.el7
          oval oval:com.redhat.rhsa:tst:20183242005
        • comment glusterfs-api-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20182892018
      • AND
        • comment glusterfs-cli is earlier than 0:3.12.2-18.el7
          oval oval:com.redhat.rhsa:tst:20183242009
        • comment glusterfs-cli is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20182892010
      • AND
        • comment glusterfs-client-xlators is earlier than 0:3.12.2-18.el7
          oval oval:com.redhat.rhsa:tst:20183242019
        • comment glusterfs-client-xlators is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20182892020
      • AND
        • comment glusterfs-devel is earlier than 0:3.12.2-18.el7
          oval oval:com.redhat.rhsa:tst:20183242021
        • comment glusterfs-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20182892008
      • AND
        • comment glusterfs-fuse is earlier than 0:3.12.2-18.el7
          oval oval:com.redhat.rhsa:tst:20183242015
        • comment glusterfs-fuse is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20182892014
      • AND
        • comment glusterfs-libs is earlier than 0:3.12.2-18.el7
          oval oval:com.redhat.rhsa:tst:20183242011
        • comment glusterfs-libs is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20182892006
      • AND
        • comment glusterfs-rdma is earlier than 0:3.12.2-18.el7
          oval oval:com.redhat.rhsa:tst:20183242023
        • comment glusterfs-rdma is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20182892016
      • AND
        • comment python2-gluster is earlier than 0:3.12.2-18.el7
          oval oval:com.redhat.rhsa:tst:20183242007
        • comment python2-gluster is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20183242008
    rhsa
    id RHSA-2018:3242
    released 2018-10-30
    severity Moderate
    title RHSA-2018:3242: glusterfs security, bug fix, and enhancement update (Moderate)
  • rhsa
    id RHSA-2018:2607
  • rhsa
    id RHSA-2018:2608
  • rhsa
    id RHSA-2018:3470
rpms
  • glusterfs-0:3.12.2-18.el6
  • glusterfs-api-0:3.12.2-18.el6
  • glusterfs-api-devel-0:3.12.2-18.el6
  • glusterfs-cli-0:3.12.2-18.el6
  • glusterfs-client-xlators-0:3.12.2-18.el6
  • glusterfs-devel-0:3.12.2-18.el6
  • glusterfs-fuse-0:3.12.2-18.el6
  • glusterfs-libs-0:3.12.2-18.el6
  • glusterfs-rdma-0:3.12.2-18.el6
  • glusterfs-0:3.12.2-18.el7
  • glusterfs-api-0:3.12.2-18.el7
  • glusterfs-api-devel-0:3.12.2-18.el7
  • glusterfs-cli-0:3.12.2-18.el7
  • glusterfs-client-xlators-0:3.12.2-18.el7
  • glusterfs-devel-0:3.12.2-18.el7
  • glusterfs-fuse-0:3.12.2-18.el7
  • glusterfs-libs-0:3.12.2-18.el7
  • glusterfs-rdma-0:3.12.2-18.el7
  • python2-gluster-0:3.12.2-18.el7
refmap via4
confirm
gentoo GLSA-201904-06
mlist [debian-lts-announce] 20180920 [SECURITY] [DLA 1510-1] glusterfs security update
Last major update 04-09-2018 - 10:29
Published 04-09-2018 - 10:29
Last modified 02-04-2019 - 03:29
Back to Top