CVE-2018-10930 — Improper Input Validation in Glusterfs

CWE-20 — Improper Input ValidationCWE-59 — Link Following13 documents8 sources
Severity
6.5MEDIUMNVD
EPSS
1.3%
top 19.91%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
8
Gluster GlusterfsRED HAT GlusterfsDebian Linux+5 more
Timeline
PublishedSep 4
Latest updateMay 13

Description

A flaw was found in RPC request using gfs3_rename_req in glusterfs server. An authenticated attacker could use this flaw to write to a destination outside the gluster volume.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages7 packages

▶NVDgluster/glusterfs3.12 — 3.12.14+1
▶Debiangluster/glusterfs< 4.1.4-1+3
▶CVEListV5red_hat/glusterfsn/a
▶NVDopensuse/leap15.1

Also affects: Debian Linux 8.0, 9.0, Enterprise Linux 6.0, 7.0

Patches

Patch: bugzilla.redhat.com ↗Patch: review.gluster.org ↗Patch: bugzilla.redhat.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-j5jm-3qm8-4wj7: A flaw was found in RPC request using gfs3_rename_req in glusterfs server↗2022-05-13
▶
CVEList
CVE-2018-10930: A flaw was found in RPC request using gfs3_rename_req in glusterfs server↗2018-09-04
▶
OSV
CVE-2018-10930: A flaw was found in RPC request using gfs3_rename_req in glusterfs server↗2018-09-04
▶

📋Vendor Advisories

4
Ubuntu
GlusterFS vulnerabilities↗2021-03-15
▶
Red Hat
glusterfs: glusterfs server exploitable via symlinks to relative paths↗2018-10-31
▶
Red Hat
glusterfs: Files can be renamed outside volume↗2018-09-04
▶
Debian
CVE-2018-10930: glusterfs - A flaw was found in RPC request using gfs3_rename_req in glusterfs server. An au...↗2018
▶

💬Community

5
Bugzilla
CVE-2018-14651 glusterfs: glusterfs server exploitable via symlinks to relative paths↗2018-09-25
▶
Bugzilla
CVE-2018-10930 glusterfs: Files can be renamed outside volume↗2018-09-05
▶
Bugzilla
CVE-2018-10930 glusterfs: Files can be renamed outside volume [fedora-all]↗2018-09-04
▶
Bugzilla
CVE-2018-10930 glusterfs: Files can be renamed outside volume↗2018-09-04
▶
Bugzilla
CVE-2018-10930 glusterfs: Files can be renamed outside volume↗2018-08-06
▶
CVE-2018-10930 — Improper Input Validation in Glusterfs | cvebase