Important: glusterfs

2023-06-0516:39:00

alas.aws.amazon.com

glusterfs

security advisory

buffer over-read

amazon linux 2

update

cve-2023-26253

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

35.7%

JSON

Issue Overview:

In Gluster GlusterFS 11.0, there is an xlators/mount/fuse/src/fuse-bridge.c notify stack-based buffer over-read. (CVE-2023-26253)

Affected Packages:

glusterfs

Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.

Issue Correction:
Run yum update glusterfs to update your system.

New Packages:

aarch64:  
    glusterfs-3.12.2-18.amzn2.0.2.aarch64  
    glusterfs-api-3.12.2-18.amzn2.0.2.aarch64  
    glusterfs-api-devel-3.12.2-18.amzn2.0.2.aarch64  
    glusterfs-cli-3.12.2-18.amzn2.0.2.aarch64  
    glusterfs-devel-3.12.2-18.amzn2.0.2.aarch64  
    glusterfs-fuse-3.12.2-18.amzn2.0.2.aarch64  
    glusterfs-libs-3.12.2-18.amzn2.0.2.aarch64  
    python2-gluster-3.12.2-18.amzn2.0.2.aarch64  
    glusterfs-rdma-3.12.2-18.amzn2.0.2.aarch64  
    glusterfs-client-xlators-3.12.2-18.amzn2.0.2.aarch64  
    glusterfs-debuginfo-3.12.2-18.amzn2.0.2.aarch64  
  
i686:  
    glusterfs-3.12.2-18.amzn2.0.2.i686  
    glusterfs-api-3.12.2-18.amzn2.0.2.i686  
    glusterfs-api-devel-3.12.2-18.amzn2.0.2.i686  
    glusterfs-cli-3.12.2-18.amzn2.0.2.i686  
    glusterfs-devel-3.12.2-18.amzn2.0.2.i686  
    glusterfs-fuse-3.12.2-18.amzn2.0.2.i686  
    glusterfs-libs-3.12.2-18.amzn2.0.2.i686  
    python2-gluster-3.12.2-18.amzn2.0.2.i686  
    glusterfs-rdma-3.12.2-18.amzn2.0.2.i686  
    glusterfs-client-xlators-3.12.2-18.amzn2.0.2.i686  
    glusterfs-debuginfo-3.12.2-18.amzn2.0.2.i686  
  
src:  
    glusterfs-3.12.2-18.amzn2.0.2.src  
  
x86_64:  
    glusterfs-3.12.2-18.amzn2.0.2.x86_64  
    glusterfs-api-3.12.2-18.amzn2.0.2.x86_64  
    glusterfs-api-devel-3.12.2-18.amzn2.0.2.x86_64  
    glusterfs-cli-3.12.2-18.amzn2.0.2.x86_64  
    glusterfs-devel-3.12.2-18.amzn2.0.2.x86_64  
    glusterfs-fuse-3.12.2-18.amzn2.0.2.x86_64  
    glusterfs-libs-3.12.2-18.amzn2.0.2.x86_64  
    python2-gluster-3.12.2-18.amzn2.0.2.x86_64  
    glusterfs-rdma-3.12.2-18.amzn2.0.2.x86_64  
    glusterfs-client-xlators-3.12.2-18.amzn2.0.2.x86_64  
    glusterfs-debuginfo-3.12.2-18.amzn2.0.2.x86_64

Additional References

Red Hat: CVE-2023-26253

Mitre: CVE-2023-26253

OSVersionArchitecturePackageVersionFilename
Amazon Linux2aarch64glusterfs< 3.12.2-18.amzn2.0.2glusterfs-3.12.2-18.amzn2.0.2.aarch64.rpm
Amazon Linux2aarch64glusterfs-api< 3.12.2-18.amzn2.0.2glusterfs-api-3.12.2-18.amzn2.0.2.aarch64.rpm
Amazon Linux2aarch64glusterfs-api-devel< 3.12.2-18.amzn2.0.2glusterfs-api-devel-3.12.2-18.amzn2.0.2.aarch64.rpm
Amazon Linux2aarch64glusterfs-cli< 3.12.2-18.amzn2.0.2glusterfs-cli-3.12.2-18.amzn2.0.2.aarch64.rpm
Amazon Linux2aarch64glusterfs-devel< 3.12.2-18.amzn2.0.2glusterfs-devel-3.12.2-18.amzn2.0.2.aarch64.rpm
Amazon Linux2aarch64glusterfs-fuse< 3.12.2-18.amzn2.0.2glusterfs-fuse-3.12.2-18.amzn2.0.2.aarch64.rpm
Amazon Linux2aarch64glusterfs-libs< 3.12.2-18.amzn2.0.2glusterfs-libs-3.12.2-18.amzn2.0.2.aarch64.rpm
Amazon Linux2aarch64python2-gluster< 3.12.2-18.amzn2.0.2python2-gluster-3.12.2-18.amzn2.0.2.aarch64.rpm
Amazon Linux2aarch64glusterfs-rdma< 3.12.2-18.amzn2.0.2glusterfs-rdma-3.12.2-18.amzn2.0.2.aarch64.rpm
Amazon Linux2aarch64glusterfs-client-xlators< 3.12.2-18.amzn2.0.2glusterfs-client-xlators-3.12.2-18.amzn2.0.2.aarch64.rpm

OS	Version	Architecture	Package	Version	Filename
Amazon Linux	2	aarch64	glusterfs	< 3.12.2-18.amzn2.0.2	glusterfs-3.12.2-18.amzn2.0.2.aarch64.rpm
Amazon Linux	2	aarch64	glusterfs-api	< 3.12.2-18.amzn2.0.2	glusterfs-api-3.12.2-18.amzn2.0.2.aarch64.rpm
Amazon Linux	2	aarch64	glusterfs-api-devel	< 3.12.2-18.amzn2.0.2	glusterfs-api-devel-3.12.2-18.amzn2.0.2.aarch64.rpm
Amazon Linux	2	aarch64	glusterfs-cli	< 3.12.2-18.amzn2.0.2	glusterfs-cli-3.12.2-18.amzn2.0.2.aarch64.rpm
Amazon Linux	2	aarch64	glusterfs-devel	< 3.12.2-18.amzn2.0.2	glusterfs-devel-3.12.2-18.amzn2.0.2.aarch64.rpm
Amazon Linux	2	aarch64	glusterfs-fuse	< 3.12.2-18.amzn2.0.2	glusterfs-fuse-3.12.2-18.amzn2.0.2.aarch64.rpm
Amazon Linux	2	aarch64	glusterfs-libs	< 3.12.2-18.amzn2.0.2	glusterfs-libs-3.12.2-18.amzn2.0.2.aarch64.rpm
Amazon Linux	2	aarch64	python2-gluster	< 3.12.2-18.amzn2.0.2	python2-gluster-3.12.2-18.amzn2.0.2.aarch64.rpm
Amazon Linux	2	aarch64	glusterfs-rdma	< 3.12.2-18.amzn2.0.2	glusterfs-rdma-3.12.2-18.amzn2.0.2.aarch64.rpm
Amazon Linux	2	aarch64	glusterfs-client-xlators	< 3.12.2-18.amzn2.0.2	glusterfs-client-xlators-3.12.2-18.amzn2.0.2.aarch64.rpm