CVE-2018-10911

glusterfs: Improper deserialization in dict.c:dict_unserialize() can allow attackers to read arbitrary memory

A flaw was found in the way dic_unserialize function of glusterfs does not handle negative key length values. An attacker could use this flaw to read memory from other locations into the stored dict value.

CVSS 3.1 · 7.5 High EPSS 2.9% KEV · Not listed

Vendors

Debian Gluster Opensuse and 1 more

Products

Debian Linux Glusterfs Leap and 6 more

CVE-2018-10910

bluez: failure in disabling Bluetooth discoverability in certain cases may lead to the unauthorized pairing of Bluetooth devices

A bug in Bluez may allow for the Bluetooth Discoverable state being set to on when no Bluetooth agent is registered with the system. This situation could lead to the unauthorized pairing of certain Bluetooth devices without any form of authentication. Versions before bluez 5.51 are vulnerable.

CVSS 3.0 · 4.5 Medium EPSS < 1% KEV · Not listed

Vendors

Bluez Canonical Redhat

Products

Bluez Ubuntu Linux Enterprise Linux

CVE-2018-10908

vdsm: calls to qemu-img are not protected by prlimit/ulimit

It was found that vdsm before version 4.20.37 invokes qemu-img on untrusted inputs without limiting resources. By uploading a specially crafted image, an attacker could cause the qemu-img process to consume unbounded amounts of memory of CPU time, causing a denial of service condition that could potentially impact other users of the host.

CVSS 3.0 · 6.5 Medium EPSS 1.2% KEV · Not listed

Vendors

Ovirt Redhat

Products

Vdsm Enterprise Linux Virtualization

CVE-2018-10907

glusterfs: Stack-based buffer overflow in server-rpc-fops.c allows remote attackers to execute arbitrary code

It was found that glusterfs server is vulnerable to multiple stack based buffer overflows due to functions in server-rpc-fopc.c allocating fixed size buffers using 'alloca(3)'. An authenticated attacker could exploit this by mounting a gluster volume and sending a string longer that the fixed buffer size to cause crash or potential code execution.

CVSS 3.1 · 8.8 High EPSS 3.3% KEV · Not listed

Vendors

Debian Gluster Opensuse and 1 more

Products

Debian Linux Glusterfs Leap and 4 more

CVE-2018-10906

fuse: bypass of the "user_allow_other" restriction when SELinux is active

In fuse before versions 2.9.8 and 3.x before 3.2.5, fusermount is vulnerable to a restriction bypass when SELinux is active. This allows non-root users to mount a FUSE file system with the 'allow_other' mount option regardless of whether 'user_allow_other' is set in the fuse configuration. An attacker may use this flaw to mount a FUSE file system, accessible by other users, and trick them into accessing files on that file system, possibly causing Denial of Service or other unspecified effects.

CVSS 3.0 · 5.3 Medium EPSS 1.4% KEV · Not listed

Vendors

Debian Fuse Project Redhat

Products

Debian Linux Fuse Enterprise Linux and 3 more

CVE-2018-10905

cfme: Improper access control in dRuby allows local users to execute arbitrary commands as root

CloudForms Management Engine (cfme) is vulnerable to an improper security setting in the dRuby component of CloudForms. An attacker with access to an unprivileged local shell could use this flaw to execute commands as a high privileged user.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Cloudforms Cloudforms Management Engine Cloudforms Managementengine

CVE-2018-10904

glusterfs: Unsanitized file names in debug/io-stats translator can allow remote attackers to execute arbitrary code

It was found that glusterfs server does not properly sanitize file paths in the "trusted.io-stats-dump" extended attribute which is used by the "debug/io-stats" translator. Attacker can use this flaw to create files and execute arbitrary code. To exploit this attacker would require sufficient access to modify the extended attributes of files on a gluster volume.

CVSS 3.1 · 8.8 High EPSS 3.0% KEV · Not listed

Vendors

Debian Gluster Opensuse and 1 more

Products

Debian Linux Glusterfs Leap and 4 more

CVE-2018-10903

python-cryptography: GCM tag forgery via truncated tag in finalize_with_tag API

A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.

CVSS 3.0 · 7.5 High EPSS 3.2% KEV · Not listed

Vendors

Canonical Cryptography Redhat

Products

Ubuntu Linux Python-cryptography Openstack

CVE-2018-10902

kernel: MIDI driver race condition leads to a double-free

It was found that the raw midi kernel driver does not protect against concurrent access which leads to a double realloc (double free) in snd_rawmidi_input_params() and snd_rawmidi_output_status() which are part of snd_rawmidi_ioctl() handler in rawmidi.c file. A malicious local attacker could possibly use this for privilege escalation.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux and 1 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 7 more

CVE-2018-10901

kernel: kvm: vmx: host GDT limit corruption

A flaw was found in Linux kernel's KVM virtualization subsystem. The VMX code does not restore the GDT.LIMIT to the previous host value, but instead sets it to 64KB. With a corrupted GDT limit a host's userspace code has an ability to place malicious entries in the GDT, particularly to the per-cpu variables. An attacker can use this to escalate their privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Linux Desktop and 6 more

CVE-2018-10899

jolokia: system-wide CSRF that could lead to Remote Code Execution

A flaw was found in Jolokia versions from 1.2 to before 1.6.1. Affected versions are vulnerable to a system-wide CSRF. This holds true for properly configured instances with strict checking for origin and referrer headers. This could result in a Remote Code Execution attack.

CVSS 3.0 · 8.1 High EPSS 2.7% KEV · Not listed

Vendors

Jolokia Redhat

Products

Jolokia Jboss Amq Jboss Fuse and 1 more

CVE-2018-10898

openstack-tripleo-heat-templates: Default ODL deployment uses hard coded administrative credentials

A vulnerability was found in openstack-tripleo-heat-templates before version 8.0.2-40. When deployed using Director using default configuration, Opendaylight in RHOSP13 is configured with easily guessable default credentials.

CVSS 3.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Openstack Redhat

Products

Tripleo Heat Templates Openstack

CVE-2018-10897

yum-utils: reposync: improper path validation may lead to directory traversal

A directory traversal issue was found in reposync, a part of yum-utils, where reposync fails to sanitize paths in remote repository configuration files. If an attacker controls a repository, they may be able to copy files outside of the destination directory on the targeted system via path traversal. If reposync is running with heightened privileges on a targeted system, this flaw could potentially result in system compromise via the overwriting of critical system files. Version 1.1.31 and older are believed to be affected.

CVSS 3.1 · 8.1 High EPSS 5.6% KEV · Not listed

Vendors

Redhat Rpm

Products

Enterprise Linux Enterprise Linux Desktop Enterprise Linux Server and 3 more

CVE-2018-10896

cloud-init: default configuration disabled deletion of SSH host keys

The default cloud-init configuration, in cloud-init 0.6.2 and newer, included "ssh_deletekeys: 0", disabling cloud-init's deletion of ssh host keys. In some environments, this could lead to instances created by cloning a golden master or template system, sharing ssh host keys, and being able to impersonate one another or conduct man-in-the-middle attacks.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Canonical Redhat

Products

Cloud-init Enterprise Linux Rhel Eus

CVE-2018-10894

keycloak: auth permitted with expired certs in SAML client

It was found that SAML authentication in Keycloak 3.4.3.Final incorrectly authenticated expired certificates. A malicious user could use this to access unauthorized data or possibly conduct further attacks.

CVSS 3.0 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Jboss Single Sign On Keycloak and 3 more

CVE-2018-10893

spice-client: Insufficient encoding checks for LZ can cause different integer/buffer overflows

Multiple integer overflow and buffer overflow issues were discovered in spice-client's handling of LZ compressed frames. A malicious server could cause the client to crash or, potentially, execute arbitrary code.

CVSS 3.0 · 7.6 High EPSS 2.4% KEV · Not listed

Vendors

Redhat Spice Project

Products

Enterprise Linux Spice

CVE-2018-10892

docker: container breakout without selinux in enforcing mode

The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block /proc/acpi pathnames. The flaw allows an attacker to modify host's hardware like enabling/disabling bluetooth or turning up/down keyboard brightness.

CVSS 3.1 · 5.3 Medium EPSS 1.1% KEV · Not listed

Vendors

Docker Mobyproject Opensuse and 1 more

Products

Docker Moby Leap and 4 more

CVE-2018-10885

atomic-openshift: Malicious network-policy can cause Openshift Routing DoS when using ovs-networkpolicy plugin

In atomic-openshift before version 3.10.9 a malicious network-policy configuration can cause Openshift Routing to crash when using ovs-networkpolicy plugin. An attacker can use this flaw to cause a Denial of Service (DoS) attack on an Openshift 3.9, or 3.7 Cluster.

CVSS 3.0 · 6.5 Medium EPSS 1.6% KEV · Not listed

Vendors

Redhat

Products

Openshift

CVE-2018-10884

ansible-tower: CSRF in awx/api/authentication.py allows for hijacking of the authtoken cookie

Ansible Tower before versions 3.1.8 and 3.2.6 is vulnerable to cross-site request forgery (CSRF) in awx/api/authentication.py. An attacker could exploit this by tricking already authenticated users into visiting a malicious site and hijacking the authtoken cookie.

CVSS 3.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Ansible Tower

CVE-2018-10883

kernel: stack-out-of-bounds write in jbd2_journal_dirty_metadata function

A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bounds write in jbd2_journal_dirty_metadata(), a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image.

CVSS 3.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux and 1 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 5 more