Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
veracodeVeracode Vulnerability DatabaseVERACODE:17418
HistoryMay 02, 2019 - 5:41 a.m.

Arbitrary Code Execution

2019-05-0205:41:25
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
6

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

JSON

Red Hat Gluster Storage is a software only scale-out storage solution that provides flexible and affordable unstructured data storage. It unifies data storage and infrastructure, increases performance, and improves availability and manageability to meet enterprise-level storage challenges. Red Hat Gluster Storage’s Unified File and Object Storage is built on OpenStack’s Object Storage (swift). A flaw was found in the metadata constraints in OpenStack Object Storage (swift). By adding metadata in several separate calls, a malicious user could bypass the max_meta_count constraint, and store more metadata than allowed by the configuration. (CVE-2014-7960) Multiple flaws were found in check-mk, a plug-in for the Nagios monitoring system, which is used to provide monitoring and alerts for the Red Hat Gluster Storage network and infrastructure: a reflected cross-site scripting flaw due improper output encoding, a flaw that could allow attackers to write .mk files in arbitrary file system locations, and a flaw that could possibly allow remote attackers to execute code in the wato (web based admin) module due to the unsafe use of the pickle() function. (CVE-2014-5338, CVE-2014-5339, CVE-2014-5340) This update also fixes numerous bugs and adds various enhancements. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Gluster Storage 3.1 Technical Notes, linked to in the References section, for information on the most significant of these changes. This advisory introduces the following new features: * NFS-Ganesha is now supported in highly available active-active environment. In a highly available active-active environment, if a NFS-Ganesha server that is connected to a NFS client running a particular application crashes, the application/NFS client is seamlessly connected to another NFS-Ganesha server without any administrative intervention. * Snapshot scheduler creates snapshots automatically based on the configured scheduled interval of time. The snapshots can be created every hour, a particular day of the month, particular month, or a particular day of the week. * You can now create a clone of a snapshot. This is a writable clone and behaves like a regular volume. A new volume can be created from a particular snapshot clone. Snapshot Clone is a technology preview feature. * Red Hat Gluster Storage supports network encryption using TLS/SSL. Red Hat Gluster Storage uses TLS/SSL for authentication and authorization, in place of the home grown authentication framework used for normal connections. * BitRot detection is a technique used in Red Hat Gluster Storage to identify the silent corruption of data with no indication from the disk to the storage software layer when the error has occurred. BitRot also helps in catching backend tinkering of bricks, where the data is directly manipulated on the bricks without going through FUSE, NFS or any other access protocols. * Glusterfind is a utility that provides the list of files that are modified between the previous backup session and the current period. This list of files can then be used by any industry standard backup application for backup. * The Parallel Network File System (pNFS) is part of the NFS v4.1 protocol that allows compute clients to access storage devices directly and in parallel. pNFS is a technology preview feature. * Tiering improves the performance, and the compliance aspects in a Red Hat Gluster Storage environment. It serves as an enabling technology for other enhancements by combining cost-effective or archivally oriented storage for the majority of user data with high-performance storage to absorb the majority of I/O workload. Tiering is a technology preview feature. All users of Red Hat Gluster Storage are advised to apply this update.

References

Related

veracode 3
redhat 3
nessus 8
securityvulns 4
fedora 6
openvas 5
prion 4
ubuntucve 4
cve 4
debiancve 1
ubuntu 1
suse 1
veracode
veracode
Improper Access Control
2019-05-02 05:41:24
Authorization Bypass
2019-01-15 09:05:26
Cross-site Scripting (XSS)
2019-01-15 09:06:54
redhat
redhat
(RHSA-2015:1495) Important: Red Hat Gluster Storage 3.1 update
2015-07-29 00:00:00
(RHSA-2015:0836) Moderate: openstack-swift security update
2015-04-16 13:12:50
(RHSA-2015:0835) Moderate: openstack-swift security update
2015-04-16 00:00:00
nessus
nessus
Check_MK 1.2.4 < 1.2.4p4 / 1.2.5 < 1.2.5i4 Multiple Vulnerabilities
2017-06-28 00:00:00
Fedora 21 : check-mk-1.2.4p5-2.fc21 (2014-11896)
2014-10-06 00:00:00
Fedora 21 : check-mk-1.2.4p5-1.fc21 (2014-11160)
2014-09-29 00:00:00
securityvulns
securityvulns
Deutsche Telekom CERT Advisory [DTC-A-20140820-001] check_mk vulnerabilities
2014-08-26 00:00:00
OpenStack Swift security vulnerabilities
2015-08-24 00:00:00
[USN-2704-1] Swift vulnerabilities
2015-08-24 00:00:00
fedora
fedora
[SECURITY] Fedora 21 Update: check-mk-1.2.4p5-2.fc21
2014-10-05 08:14:05
[SECURITY] Fedora 21 Update: check-mk-1.2.4p5-1.fc21
2014-09-27 10:06:43
[SECURITY] Fedora 19 Update: check-mk-1.2.4p5-1.fc19
2014-09-27 09:43:00
openvas
openvas
Fedora Update for check-mk FEDORA-2014-11895
2014-10-11 00:00:00
Fedora Update for check-mk FEDORA-2014-11929
2014-10-11 00:00:00
Fedora Update for check-mk FEDORA-2014-10972
2014-10-01 00:00:00
prion
prion
Design/Logic Flaw
2014-10-17 15:55:00
Cross site scripting
2014-08-22 14:55:00
Code injection
2014-09-02 14:55:00
ubuntucve
ubuntucve
CVE-2014-7960
2014-10-17 00:00:00
CVE-2014-5339
2014-09-02 00:00:00
CVE-2014-5338
2014-08-22 00:00:00
cve
cve
CVE-2014-7960
2014-10-17 15:55:00
CVE-2014-5338
2014-08-22 14:55:00
CVE-2014-5339
2014-09-02 14:55:00
debiancve
debiancve
CVE-2014-7960
2014-10-17 15:55:00
ubuntu
ubuntu
Swift vulnerabilities
2015-08-06 00:00:00
suse
suse
Security update for openstack-swift (important)
2015-10-30 12:09:49

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

JSON
Related for VERACODE:17418
veracode3redhat3nessus8securityvulns4fedora6openvas5prion4ubuntucve4cve4debiancve1ubuntu1suse1