CVE-2018-10929 — Improper Input Validation in Glusterfs

CWE-20 — Improper Input ValidationCWE-59 — Link Following11 documents8 sources
Severity
8.8HIGHNVD
EPSS
1.7%
top 17.78%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Gluster GlusterfsRED HAT GlusterfsDebian Linux+3 more
Timeline
PublishedSep 4
Latest updateMay 13

Description

A flaw was found in RPC request using gfs2_create_req in glusterfs server. An authenticated attacker could use this flaw to create arbitrary files and execute arbitrary code on glusterfs server nodes.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages6 packages

▶NVDgluster/glusterfs3.12 — 3.12.14+1
▶Debiangluster/glusterfs< 4.1.4-1+3
▶CVEListV5red_hat/glusterfsn/a
▶NVDopensuse/leap15.1

Also affects: Debian Linux 8.0, 9.0

Patches

Patch: bugzilla.redhat.com ↗Patch: bugzilla.redhat.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-pmrg-xrj2-vxj8: A flaw was found in RPC request using gfs2_create_req in glusterfs server↗2022-05-13
▶
CVEList
CVE-2018-10929: A flaw was found in RPC request using gfs2_create_req in glusterfs server↗2018-09-04
▶
OSV
CVE-2018-10929: A flaw was found in RPC request using gfs2_create_req in glusterfs server↗2018-09-04
▶

📋Vendor Advisories

4
Ubuntu
GlusterFS vulnerabilities↗2021-03-15
▶
Red Hat
glusterfs: glusterfs server exploitable via symlinks to relative paths↗2018-10-31
▶
Red Hat
glusterfs: Arbitrary file creation on storage server allows for execution of arbitrary code↗2018-09-04
▶
Debian
CVE-2018-10929: glusterfs - A flaw was found in RPC request using gfs2_create_req in glusterfs server. An au...↗2018
▶

💬Community

3
Bugzilla
CVE-2018-14651 glusterfs: glusterfs server exploitable via symlinks to relative paths↗2018-09-25
▶
Bugzilla
CVE-2018-10929 glusterfs: Arbitrary file creation on storage server allows for execution of arbitrary code [fedora-all]↗2018-09-04
▶
Bugzilla
CVE-2018-10929 glusterfs: Arbitrary file creation on storage server allows for execution of arbitrary code↗2018-08-06
▶
CVE-2018-10929 — Improper Input Validation in Glusterfs | cvebase