Vulnerabilities > CVE-2018-10841
Attack vector
NETWORK Attack complexity
LOW Privileges required
LOW Confidentiality impact
HIGH Integrity impact
HIGH Availability impact
HIGH Summary
glusterfs is vulnerable to privilege escalation on gluster server nodes. An authenticated gluster client via TLS could use gluster cli with --remote-host command to add it self to trusted storage pool and perform privileged gluster operations like adding other machines to trusted storage pool, start, stop, and delete volumes.
Vulnerable Configurations
Nessus
NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2018-1955.NASL description An update for glusterfs is now available for Native Client for Red Hat Enterprise Linux 6 for Red Hat Storage and Red Hat Gluster Storage 3.3 for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. GlusterFS is a key building block of Red Hat Gluster Storage. It is based on a stackable user-space design and can deliver exceptional performance for diverse workloads. GlusterFS aggregates various storage servers over network interconnections into one large, parallel network file system. Security Fix : * glusterfs: access trusted peer group via remote-host command (CVE-2018-10841) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. last seen 2020-06-01 modified 2020-06-02 plugin id 110631 published 2018-06-21 reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/110631 title RHEL 6 : glusterfs (RHSA-2018:1955) NASL family Fedora Local Security Checks NASL id FEDORA_2018-D873767641.NASL description 4.1.1 GA, security fix for CVE-2018-10841 ---- 4.1.0 GA Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-05 modified 2019-01-03 plugin id 120834 published 2019-01-03 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/120834 title Fedora 28 : glusterfs (2018-d873767641) NASL family Huawei Local Security Checks NASL id EULEROS_SA-2018-1229.NASL description According to the version of the glusterfs packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A flaw was found in glusterfs which can lead to privilege escalation on gluster server nodes. An authenticated gluster client via TLS could use gluster cli with --remote-host command to add it self to trusted storage pool and perform privileged gluster operations like adding other machines to trusted storage pool, start, stop, and delete volumes.(CVE-2018-10841) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-05-06 modified 2018-08-10 plugin id 111649 published 2018-08-10 reporter This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/111649 title EulerOS 2.0 SP3 : glusterfs (EulerOS-SA-2018-1229) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2018-1954.NASL description An update for glusterfs is now available for Native Client for Red Hat Enterprise Linux 7 for Red Hat Storage and Red Hat Gluster Storage 3.3 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. GlusterFS is a key building block of Red Hat Gluster Storage. It is based on a stackable user-space design and can deliver exceptional performance for diverse workloads. GlusterFS aggregates various storage servers over network interconnections into one large, parallel network file system. Security Fix : * glusterfs: access trusted peer group via remote-host command (CVE-2018-10841) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. last seen 2020-06-01 modified 2020-06-02 plugin id 110630 published 2018-06-21 reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/110630 title RHEL 7 : glusterfs (RHSA-2018:1954) NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-201904-06.NASL description The remote host is affected by the vulnerability described in GLSA-201904-06 (GlusterFS: Multiple Vulnerabilities) Multiple vulnerabilities have been discovered in GlusterFS. Please review the referenced CVE identifiers for details. Impact : Please review the referenced CVE identifiers for details. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 123580 published 2019-04-02 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/123580 title GLSA-201904-06 : GlusterFS: Multiple Vulnerabilities
Redhat
| advisories |
| ||||||||
| rpms |
|
References
- https://access.redhat.com/errata/RHSA-2018:1954
- https://access.redhat.com/errata/RHSA-2018:1954
- https://access.redhat.com/errata/RHSA-2018:1955
- https://access.redhat.com/errata/RHSA-2018:1955
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10841
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10841
- https://lists.debian.org/debian-lts-announce/2021/11/msg00000.html
- https://lists.debian.org/debian-lts-announce/2021/11/msg00000.html
- https://review.gluster.org/#/c/20328/
- https://review.gluster.org/#/c/20328/
- https://security.gentoo.org/glsa/201904-06
- https://security.gentoo.org/glsa/201904-06