PT-2018-10190 · Red Hat+3 · Glusterfs Server+3

Michael Hanselmann + 1 · Published 2018-09-04 · Updated 2022-04-12 · CVE-2018-10929

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions glusterfs server (affected versions not specified)

Description A flaw was found in the RPC request using gfs2 create req in the glusterfs server. An authenticated attacker could use this flaw to create arbitrary files and execute arbitrary code on glusterfs server nodes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CESA-2018_2607

CVE-2018-10929

DLA-1510-1

DLA-1565-1

DLA-2806-1

OPENSUSE-SU-2020:0079-1

OPENSUSE-SU-2020_0079-1

RHSA-2018:2607

RHSA-2018:2608

RHSA-2018:3470

USN-4770-1

Affected Products

Centos

Suse

Ubuntu

Glusterfs Server

References · 124

• https://ubuntu.com/security/CVE-2018-10924 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00035.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/DLA-1565-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-14659 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-10926 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-10911 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14653 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3619 · Security Note
• https://access.redhat.com/errata/RHSA-2018:3470 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:0079-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-10929 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1565-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14661 · Security Note
• https://osv.dev/vulnerability/USN-4770-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2607 · Vendor Advisory