Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 23

Export CSV
CVE-2018-10907

glusterfs: Stack-based buffer overflow in server-rpc-fops.c allows remote attackers to execute arbitrary code

It was found that glusterfs server is vulnerable to multiple stack based buffer overflows due to functions in server-rpc-fopc.c allocating fixed size buffers using 'alloca(3)'. An authenticated attacker could exploit this by mounting a gluster volume and sending a string longer that the fixed buffer size to cause crash or potential code execution.

CVSS 3.1 · 8.8 High EPSS 3.3% KEV · Not listed
Vendors
Debian Gluster Opensuse and 1 more
Products
Debian Linux Glusterfs Leap and 4 more
CVE-2018-10904

glusterfs: Unsanitized file names in debug/io-stats translator can allow remote attackers to execute arbitrary code

It was found that glusterfs server does not properly sanitize file paths in the "trusted.io-stats-dump" extended attribute which is used by the "debug/io-stats" translator. Attacker can use this flaw to create files and execute arbitrary code. To exploit this attacker would require sufficient access to modify the extended attributes of files on a gluster volume.

CVSS 3.1 · 8.8 High EPSS 3.0% KEV · Not listed
Vendors
Debian Gluster Opensuse and 1 more
Products
Debian Linux Glusterfs Leap and 4 more
CVE-2018-10841

glusterfs: access trusted peer group via remote-host command

glusterfs is vulnerable to privilege escalation on gluster server nodes. An authenticated gluster client via TLS could use gluster cli with --remote-host command to add it self to trusted storage pool and perform privileged gluster operations like adding other machines to trusted storage pool, start, stop, and delete volumes.

CVSS 3.1 · 8.8 High EPSS 1.2% KEV · Not listed
Vendors
Debian Gluster Redhat
Products
Debian Linux Glusterfs Enterprise Linux and 1 more