PT-2018-10440 · Red Hat · Red Hat Gluster Storage

Sidhax · Publicado 2018-09-11 · Atualizado 2019-10-09 · CVE-2018-1127

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Red Hat Gluster Storage versions prior to 3.4.0

Description The issue allows attackers to replay session tokens and authenticate as the target user. This can occur when session tokens remain active for a few minutes after a user logs out, enabling attackers to use tokens acquired via sniffing or man-in-the-middle (MITM) attacks.

Recommendations For versions prior to 3.4.0, update to version 3.4.0 or later to resolve the issue.

Correção

Session Fixation

Insufficient Session Expiration

Enumeração de Fraquezas

CWE-384

CWE-613

Identificadores relacionados

CVE-2018-1127

RHSA-2018:2616

Produtos afetados

Red Hat Gluster Storage

Referências · 6

• https://github.com/Tendrl/api/pull/422 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2018-1127 · Nota de Segurança
• https://access.redhat.com/errata/RHSA-2018:2616 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1127 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-1127 · Aviso do Fabricante
• http://securitytracker.com/id/1041597 · Nota