8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:S/C:N/I:C/A:C
0.008 Low
EPSS
Percentile
81.8%
GlusterFS is a key building block of Red Hat Gluster Storage. It is based on a stackable user-space design and can deliver exceptional performance for diverse workloads. GlusterFS aggregates various storage servers over network interconnections into one large, parallel network file system.
Security Fix(es):
glusterfs: glusterfs server exploitable via symlinks to relative paths (CVE-2018-14651)
glusterfs: Buffer overflow in “features/locks” translator allows for denial of service (CVE-2018-14652)
glusterfs: Heap-based buffer overflow via “gf_getspec_req” RPC message (CVE-2018-14653)
glusterfs: “features/index” translator can create arbitrary, empty files (CVE-2018-14654)
glusterfs: Unlimited file creation via “GF_XATTR_IOSTATS_DUMP_KEY” xattr allows for denial of service (CVE-2018-14659)
glusterfs: Repeat use of “GF_META_LOCK_KEY” xattr allows for memory exhaustion (CVE-2018-14660)
glusterfs: features/locks translator passes an user-controlled string to snprintf without a proper format string resulting in a denial of service (CVE-2018-14661)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
Red Hat would like to thank Michael Hanselmann (hansmi.ch) for reporting these issues.
Bug Fix(es):
MD5 instances are replaced with FIPS-compliant SHA256 checksums and glusterd no longer crashes when run on a FIPS enabled machine. (BZ#1459709)
The flock is unlocked specifically and the status file is updated so that the reference is not leaked to any worker or agent process. As a result of this fix, all workers come up without fail. (BZ#1623749)
All HTIME index files are checked for the specified start and end times, and the History API does not fail when multiple HTIME files exist. (BZ#1627639)
After upgrading to Red Hat Gluster Storage 3.4 from earlier versions of Red Hat Gluster Storage, the volume size displayed by the df command was smaller than the actual volume size. This has been fixed and the df command now shows the correct size for all volumes. (BZ#1630997)
The algorithm to disable the eager-lock is modified and it disables only when multiple write operations are trying to modify a file at the same time. This led to performance improvement while a write operation is performed on a file irrespective of the number of times it is opened at the same time for a read operation. (BZ#1630688)
heal-info does not consider the presence of dirty markers as an indication of split-brain and does not display these entries to be in a split-brain state. (BZ#1610743)
All users of Red Hat Gluster Storage are advised to upgrade to these updated packages, which provide numerous bug fixes and enhancements.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
RedHat | 7 | x86_64 | glusterfs-ganesha | < 3.12.2-25.el7rhgs | glusterfs-ganesha-3.12.2-25.el7rhgs.x86_64.rpm |
RedHat | 7 | x86_64 | glusterfs-debuginfo | < 3.12.2-25.el7rhgs | glusterfs-debuginfo-3.12.2-25.el7rhgs.x86_64.rpm |
RedHat | 7 | x86_64 | glusterfs-client-xlators | < 3.12.2-25.el7rhgs | glusterfs-client-xlators-3.12.2-25.el7rhgs.x86_64.rpm |
RedHat | 7 | noarch | glusterfs-resource-agents | < 3.12.2-25.el7rhgs | glusterfs-resource-agents-3.12.2-25.el7rhgs.noarch.rpm |
RedHat | 7 | x86_64 | glusterfs-libs | < 3.12.2-25.el7rhgs | glusterfs-libs-3.12.2-25.el7rhgs.x86_64.rpm |
RedHat | 7 | noarch | redhat-storage-server | < 3.4.1.0-1.el7rhgs | redhat-storage-server-3.4.1.0-1.el7rhgs.noarch.rpm |
RedHat | 7 | x86_64 | glusterfs | < 3.12.2-25.el7rhgs | glusterfs-3.12.2-25.el7rhgs.x86_64.rpm |
RedHat | 7 | x86_64 | glusterfs-api | < 3.12.2-25.el7 | glusterfs-api-3.12.2-25.el7.x86_64.rpm |
RedHat | 7 | x86_64 | glusterfs-cli | < 3.12.2-25.el7 | glusterfs-cli-3.12.2-25.el7.x86_64.rpm |
RedHat | 7 | x86_64 | glusterfs-server | < 3.12.2-25.el7rhgs | glusterfs-server-3.12.2-25.el7rhgs.x86_64.rpm |
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:S/C:N/I:C/A:C
0.008 Low
EPSS
Percentile
81.8%