PT-2018-10135 · Red Hat+2 · Glusterfs+2

Mohit Agrawal · Published 2018-06-20 · Updated 2023-02-12 · CVE-2018-10841

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions glusterfs (affected versions not specified)

Description The issue allows for privilege escalation on gluster server nodes. An authenticated gluster client using TLS can exploit this by utilizing the gluster cli with the --remote-host command. This enables the client to add itself to the trusted storage pool and perform privileged gluster operations, including adding other machines to the trusted storage pool, as well as starting, stopping, and deleting volumes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

ALT-PU-2018-2006

CVE-2018-10841

DLA-2806-1

RHSA-2018:1954

RHSA-2018:1955

USN-4770-1

Affected Products

Alt Linux

Ubuntu

Glusterfs

References · 71

• https://ubuntu.com/security/CVE-2018-10924 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-10841 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10928 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-10841 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10911 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10923 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1088 · Security Note
• https://ubuntu.com/security/CVE-2018-10913 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-14659 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-10926 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-10923 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-10911 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14653 · Security Note
• https://ubuntu.com/security/CVE-2018-10914 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3619 · Security Note