Bug 1632557 (CVE-2018-14651)
Summary: | CVE-2018-14651 glusterfs: glusterfs server exploitable via symlinks to relative paths | ||
---|---|---|---|
Product: | [Other] Security Response | Reporter: | Sam Fowler <sfowler> |
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
Status: | CLOSED ERRATA | QA Contact: | |
Severity: | high | Docs Contact: | |
Priority: | high | ||
Version: | unspecified | CC: | abhgupta, anoopcs, atumball, bmcclain, carnil, dbaker, dblechte, dfediuck, eedri, humble.devassy, jokerman, jonathansteffan, kkeithle, matthias, mgoldboi, michal.skrivanek, ndevos, public, ramkrsna, rhs-bugs, sankarshan, sbonazzo, security-response-team, sfowler, sherold, sisharma, ssaha, sthangav, trankin, vbellur |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | Doc Type: | If docs needed, set a value | |
Doc Text: |
It was found that the fix for CVE-2018-10927, CVE-2018-10928, CVE-2018-10929, CVE-2018-10930, and CVE-2018-10926 was incomplete. A remote, authenticated attacker could use one of these flaws to execute arbitrary code, create arbitrary files, or cause denial of service on glusterfs server nodes via symlinks to relative paths.
|
Story Points: | --- |
Clone Of: | Environment: | ||
Last Closed: | 2019-06-10 10:38:41 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 1633013, 1644730, 1644755, 1647663, 1647667 | ||
Bug Blocks: | 1631574, 1644080 |
Description
Sam Fowler
2018-09-25 05:33:35 UTC
Acknowledgments: Name: Michael Hanselmann (hansmi.ch) Statement: This issue did not affect Red Hat Enterprise Linux 6 and 7 as the flaw is present in glusterfs-server, which is not shipped there. This issue has been addressed in the following products: Red Hat Gluster Storage 3.4 for RHEL 6 Native Client for RHEL 6 for Red Hat Storage Via RHSA-2018:3431 https://access.redhat.com/errata/RHSA-2018:3431 This issue has been addressed in the following products: Red Hat Gluster Storage 3.4 for RHEL 7 Native Client for RHEL 7 for Red Hat Storage Via RHSA-2018:3432 https://access.redhat.com/errata/RHSA-2018:3432 Created glusterfs tracking bugs for this issue: Affects: fedora-all [bug 1644730] Can you share information on the fixing commit(s) for the CVE-2018-14651 issue (and in the other bugs respectively)? Redirecting needinfo to Siddharth. upstream fix: https://review.gluster.org/#/c/glusterfs/+/21527/ |