PT-2018-10135 · Red Hat+2 · Glusterfs+2

Mohit Agrawal · Publicado 2018-06-20 · Atualizado 2023-02-12 · CVE-2018-10841

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions glusterfs (affected versions not specified)

Description The issue allows for privilege escalation on gluster server nodes. An authenticated gluster client using TLS can exploit this by utilizing the gluster cli with the --remote-host command. This enables the client to add itself to the trusted storage pool and perform privileged gluster operations, including adding other machines to the trusted storage pool, as well as starting, stopping, and deleting volumes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Authentication Bypass Using an Alternate Path or Channel

Enumeração de Fraquezas

CWE-288

Identificadores relacionados

ALT-PU-2018-2006

CVE-2018-10841

DLA-2806-1

RHSA-2018:1954

RHSA-2018:1955

USN-4770-1

Produtos afetados

Alt Linux

Ubuntu

Glusterfs

Referências · 71

• https://github.com/MauroEldritch/GEVAUDAN · Nota
• https://ubuntu.com/security/CVE-2018-10924 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2018-10841 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10928 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-10841 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10911 · Nota de Segurança
• https://lists.debian.org/debian-lts-announce/2021/11/msg00000.html · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10923 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1088 · Nota de Segurança
• https://ubuntu.com/security/CVE-2018-10913 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-14659 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-10926 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-10923 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-10911 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14653 · Nota de Segurança