8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
6.5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
PowerKVM is affected by vulnerabilities in glusterfs. IBM has now addressed these vulnerabilities.
CVEID: CVE-2018-10913 DESCRIPTION: glusterfs could allow a remote attacker to obtain sensitive information, caused by improper handling of xattr request. By sending a specially-crafted request, a remote attacker could exploit this vulnerability to determine the existence of arbitrary files on the system.
CVSS Base Score: 4.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/149299> for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
CVEID: CVE-2018-10911 DESCRIPTION: glusterfs could allow a remote authenticated attacker to obtain sensitive information, caused by improper handling of negative key length values in the dict.c:dict_unserialize function. By sending a specially-crafted request, a remote attacker could exploit this vulnerability to read memory from other locations into the stored dict value.
CVSS Base Score: 6.5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/149298> for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVEID: CVE-2018-10907 DESCRIPTION: glusterfs is vulnerable to a denial of service, caused by multiple stack-based buffer overflow in unctions in server-rpc-fopc.c. By mounting a gluster volume and sending specially-crafted data, a remote authenticated attacker could exploit this vulnerability to cause a denial of service condition or execute arbitrary code on the system.
CVSS Base Score: 8.8
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/149297> for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVEID: CVE-2018-10928 DESCRIPTION: glusterfs could allow a remote authenticated attacker to execute arbitrary code on the system, caused by improper validation of RPC request using gfs3_symlink_req function. By sending a specially-crafted request, an attacker could exploit this vulnerability to create arbitrary symlinks and execute arbitrary code on the system.
CVSS Base Score: 8.8
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/149305> for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVEID: CVE-2018-10927 DESCRIPTION: glusterfs could allow a remote authenticated attacker to obtain sensitive information, caused by improper validation of RPC request in gfs3_lookup_req function. By sending a specially-crafted request, a remote attacker could exploit this vulnerability to obtain sensitive information and cause a denial of service condition.
CVSS Base Score: 8.1
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/149304> for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
CVEID: CVE-2018-10926 DESCRIPTION: glusterfs could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a flaw in RPC request using gfs3_mknod_req function. By sending a specially-crafted request, an attacker could exploit this vulnerability to create files and execute arbitrary code on the system.
CVSS Base Score: 8.8
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/149303> for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVEID: CVE-2018-10923 DESCRIPTION: glusterfs could allow a remote authenticated attacker to obtain sensitive information, caused by a flaw in the mknod call derived from mknod(2). By creating arbitrary devices on a glusterfs server node, an attacker could exploit this vulnerability to read arbitrary data from the attached device.
CVSS Base Score: 6.5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/149301> for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVEID: CVE-2018-10914 DESCRIPTION: glusterfs is vulnerable to a denial of service, caused by improper validation of xattr request. By sending a specially-crafted request, a remote attacker could exploit this vulnerability to crash multiple bricks and gluster volumes.
CVSS Base Score: 7.5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/149300> for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVEID: CVE-2018-10930 DESCRIPTION: glusterfs ould allow a remote authenticated attacker to bypass security restrictions, caused by improper validation of RPC request using gfs3_rename_req function. By sending a specially-crafted request, an attacker could exploit this vulnerability to write to a destination outside the gluster volume.
CVSS Base Score: 6.5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/149307> for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
CVEID: CVE-2018-10929 DESCRIPTION: glusterfs could allow a remote authenticated attacker to execute arbitrary code on the system, caused by improper validation of RPC request using gfs2_create_req function. By sending a specially-crafted request, an attacker could exploit this vulnerability to create files and execute arbitrary code on the system.
CVSS Base Score: 8.8
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/149306> for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVEID: CVE-2018-10904 DESCRIPTION: glusterfs could allow a remote authenticated attacker to execute arbitrary code on the system, caused by improper validation of file paths in the trusted.io-stats-dump extended attribute. By sending a specially-crafted request, an attacker could exploit this vulnerability to create files and execute arbitrary code on the system.
CVSS Base Score: 8.8
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/149295> for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
PowerKVM 3.1
Customers can update PowerKVM systems by using “yum update”.
Fix images are made available via Fix Central. For version 3.1, see https://ibm.biz/BdHggw. This issue is addressed starting with v3.1.0.2 update 16.
none
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
6.5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P