CVE-2018-14659

The Gluster file system through versions 4.1.4 and 3.1.2 is vulnerable to a denial of service attack via use of the 'GFXATTRIOSTATSDUMPKEY' xattr. A remote, authenticated attacker could exploit this by mounting a Gluster volume and repeatedly calling 'setxattr2' to trigger a state dump and create...

PT-2018-12645 · Red Hat +1 · Gluster +1

Name of the Vulnerable Software and Affected Versions: Gluster file system versions through 4.1.4 Description: The issue allows a remote attacker with access to mount volumes to exploit the GF XATTROP ENTRY IN KEY xattrop, creating arbitrary, empty files on the target server via abuse of the...

PT-2018-12643 · Red Hat +1 · Gluster +1

Name of the Vulnerable Software and Affected Versions: Gluster file system versions prior to 4.1.5 Description: The issue is related to a buffer overflow in the 'features/index' translator, specifically in the code handling the GF XATTR CLRLK CMD xattr within the pl getxattr function. This could ...

PT-2018-12644 · Red Hat +1 · Gluster +1

Name of the Vulnerable Software and Affected Versions: Gluster file system versions 3.12 through 4.1.4 Description: The issue is related to a heap-based buffer overflow in the server getspec function, which can be triggered via the gf getspec req RPC message. This could allow a remote authenticat...

PT-2018-12649 · Red Hat +1 · Gluster +1

Name of the Vulnerable Software and Affected Versions: Gluster file system versions 3.1.2 through 4.1.4 Description: The issue allows a remote, authenticated attacker to perform a denial of service attack by utilizing the GF XATTR IOSTATS DUMP KEY xattr. This can be exploited by mounting a Gluste...

Red Hat glusterfs server arbitrary file read vulnerability

Red Hat glusterfs server is an open source distributed file system from Red Hat Red Hat. The system is mainly for media streaming , data analysis and other data and bandwidth intensive tasks to create large-scale distributed storage solutions. A security vulnerability exists in the Red Hat...

UBUNTU-CVE-2018-10911

A flaw was found in the way dicunserialize function of glusterfs does not handle negative key length values. An attacker could use this flaw to read memory from other locations into the stored dict value...