Vulnerabilities > CVE-2018-10928 - Link Following vulnerability in multiple products

047910
CVSS 6.5 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
SINGLE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
debian
redhat
gluster
opensuse
CWE-59
nessus

Summary

A flaw was found in RPC request using gfs3_symlink_req in glusterfs server which allows symlink destinations to point to file paths outside of the gluster volume. An authenticated attacker could use this flaw to create arbitrary symlinks pointing anywhere on the server and execute arbitrary code on glusterfs server nodes.

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Symlink Attack
    An attacker positions a symbolic link in such a manner that the targeted user or application accesses the link's endpoint, assuming that it is accessing a file with the link's name. The endpoint file may be either output or input. If the file is output, the result is that the endpoint is modified, instead of a file at the intended location. Modifications to the endpoint file may include appending, overwriting, corrupting, changing permissions, or other modifications. In some variants of this attack the attacker may be able to control the change to a file while in other cases they cannot. The former is especially damaging since the attacker may be able to grant themselves increased privileges or insert false information, but the latter can also be damaging as it can expose sensitive information or corrupt or destroy vital system or application files. Alternatively, the endpoint file may serve as input to the targeted application. This can be used to feed malformed input into the target or to cause the target to process different information, possibly allowing the attacker to control the actions of the target or to cause the target to expose information to the attacker. Moreover, the actions taken on the endpoint file are undertaken with the permissions of the targeted user or application, which may exceed the permissions that the attacker would normally have.
  • Accessing, Modifying or Executing Executable Files
    An attack of this type exploits a system's configuration that allows an attacker to either directly access an executable file, for example through shell access; or in a possible worst case allows an attacker to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.
  • Leverage Executable Code in Non-Executable Files
    An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high. The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/) http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process. The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name "public" grants all users with the public role the ability to use the administration functionality. The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
  • Manipulating Input to File System Calls
    An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.

Nessus

  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-1510.NASL
    descriptionMultiple security vulnerabilities were discovered in GlusterFS, a clustered file system. Buffer overflows and path traversal issues may lead to information disclosure, denial of service or the execution of arbitrary code. To resolve the security vulnerabilities the following limitations were made in GlusterFS : - open,read,write on special files like char and block are no longer permitted - io-stat xlator can dump stat info only to /run/gluster directory For Debian 8
    last seen2020-06-01
    modified2020-06-02
    plugin id117618
    published2018-09-21
    reporterThis script is Copyright (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/117618
    titleDebian DLA-1510-1 : glusterfs security update
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Debian Security Advisory DLA-1510-1. The text
    # itself is copyright (C) Software in the Public Interest, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(117618);
      script_version("1.2");
      script_cvs_date("Date: 2018/10/24 12:17:51");
    
      script_cve_id("CVE-2018-10904", "CVE-2018-10907", "CVE-2018-10911", "CVE-2018-10913", "CVE-2018-10914", "CVE-2018-10923", "CVE-2018-10926", "CVE-2018-10927", "CVE-2018-10928", "CVE-2018-10929", "CVE-2018-10930");
    
      script_name(english:"Debian DLA-1510-1 : glusterfs security update");
      script_summary(english:"Checks dpkg output for the updated packages.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Debian host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Multiple security vulnerabilities were discovered in GlusterFS, a
    clustered file system. Buffer overflows and path traversal issues may
    lead to information disclosure, denial of service or the execution of
    arbitrary code.
    
    To resolve the security vulnerabilities the following limitations were
    made in GlusterFS :
    
      - open,read,write on special files like char and block are
        no longer permitted
    
      - io-stat xlator can dump stat info only to /run/gluster
        directory
    
    For Debian 8 'Jessie', these problems have been fixed in version
    3.5.2-2+deb8u4.
    
    We recommend that you upgrade your glusterfs packages.
    
    NOTE: Tenable Network Security has extracted the preceding description
    block directly from the DLA security advisory. Tenable has attempted
    to automatically clean and format it as much as possible without
    introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://lists.debian.org/debian-lts-announce/2018/09/msg00021.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://packages.debian.org/source/jessie/glusterfs"
      );
      script_set_attribute(attribute:"solution", value:"Upgrade the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:glusterfs-client");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:glusterfs-common");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:glusterfs-dbg");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:glusterfs-server");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:8.0");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2018/09/20");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/09/21");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Debian Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("debian_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"8.0", prefix:"glusterfs-client", reference:"3.5.2-2+deb8u4")) flag++;
    if (deb_check(release:"8.0", prefix:"glusterfs-common", reference:"3.5.2-2+deb8u4")) flag++;
    if (deb_check(release:"8.0", prefix:"glusterfs-dbg", reference:"3.5.2-2+deb8u4")) flag++;
    if (deb_check(release:"8.0", prefix:"glusterfs-server", reference:"3.5.2-2+deb8u4")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());
      else security_warning(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-1565.NASL
    descriptionMultiple security vulnerabilities were discovered in GlusterFS, a clustered file system. Buffer overflows and path traversal issues may lead to information disclosure, denial of service or the execution of arbitrary code. CVE-2018-14651 It was found that the fix for CVE-2018-10927, CVE-2018-10928, CVE-2018-10929, CVE-2018-10930, and CVE-2018-10926 was incomplete. A remote, authenticated attacker could use one of these flaws to execute arbitrary code, create arbitrary files, or cause denial of service on glusterfs server nodes via symlinks to relative paths. CVE-2018-14652 The Gluster file system is vulnerable to a buffer overflow in the
    last seen2020-06-01
    modified2020-06-02
    plugin id118733
    published2018-11-06
    reporterThis script is Copyright (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/118733
    titleDebian DLA-1565-1 : glusterfs security update
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Debian Security Advisory DLA-1565-1. The text
    # itself is copyright (C) Software in the Public Interest, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(118733);
      script_version("1.3");
      script_cvs_date("Date: 2018/12/13 16:48:47");
    
      script_cve_id("CVE-2018-14651", "CVE-2018-14652", "CVE-2018-14653", "CVE-2018-14659", "CVE-2018-14661");
    
      script_name(english:"Debian DLA-1565-1 : glusterfs security update");
      script_summary(english:"Checks dpkg output for the updated packages.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Debian host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Multiple security vulnerabilities were discovered in GlusterFS, a
    clustered file system. Buffer overflows and path traversal issues may
    lead to information disclosure, denial of service or the execution of
    arbitrary code.
    
    CVE-2018-14651
    
    It was found that the fix for CVE-2018-10927, CVE-2018-10928,
    CVE-2018-10929, CVE-2018-10930, and CVE-2018-10926 was incomplete. A
    remote, authenticated attacker could use one of these flaws to execute
    arbitrary code, create arbitrary files, or cause denial of service on
    glusterfs server nodes via symlinks to relative paths.
    
    CVE-2018-14652
    
    The Gluster file system is vulnerable to a buffer overflow in the
    'features/index' translator via the code handling the
    'GF_XATTR_CLRLK_CMD' xattr in the 'pl_getxattr' function. A remote
    authenticated attacker could exploit this on a mounted volume to cause
    a denial of service.
    
    CVE-2018-14653
    
    The Gluster file system is vulnerable to a heap-based buffer overflow
    in the '__server_getspec' function via the 'gf_getspec_req' RPC
    message. A remote authenticated attacker could exploit this to cause a
    denial of service or other potential unspecified impact.
    
    CVE-2018-14659
    
    The Gluster file system is vulnerable to a denial of service attack
    via use of the 'GF_XATTR_IOSTATS_DUMP_KEY' xattr. A remote,
    authenticated attacker could exploit this by mounting a Gluster volume
    and repeatedly calling 'setxattr(2)' to trigger a state dump and
    create an arbitrary number of files in the server's runtime directory.
    
    CVE-2018-14661
    
    It was found that usage of snprintf function in feature/locks
    translator of glusterfs server was vulnerable to a format string
    attack. A remote, authenticated attacker could use this flaw to cause
    remote denial of service.
    
    For Debian 8 'Jessie', these problems have been fixed in version
    3.5.2-2+deb8u5.
    
    We recommend that you upgrade your glusterfs packages.
    
    NOTE: Tenable Network Security has extracted the preceding description
    block directly from the DLA security advisory. Tenable has attempted
    to automatically clean and format it as much as possible without
    introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://lists.debian.org/debian-lts-announce/2018/11/msg00003.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://packages.debian.org/source/jessie/glusterfs"
      );
      script_set_attribute(attribute:"solution", value:"Upgrade the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:glusterfs-client");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:glusterfs-common");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:glusterfs-dbg");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:glusterfs-server");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:8.0");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2018/11/05");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/11/06");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Debian Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("debian_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"8.0", prefix:"glusterfs-client", reference:"3.5.2-2+deb8u5")) flag++;
    if (deb_check(release:"8.0", prefix:"glusterfs-common", reference:"3.5.2-2+deb8u5")) flag++;
    if (deb_check(release:"8.0", prefix:"glusterfs-dbg", reference:"3.5.2-2+deb8u5")) flag++;
    if (deb_check(release:"8.0", prefix:"glusterfs-server", reference:"3.5.2-2+deb8u5")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());
      else security_warning(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2018-2607.NASL
    descriptionUpdated glusterfs packages that fix multiple security issues and bugs, and add various enhancements are now available for Red Hat Gluster Storage 3.4 on Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. GlusterFS is a key building block of Red Hat Gluster Storage. It is based on a stackable user-space design and can deliver exceptional performance for diverse workloads. GlusterFS aggregates various storage servers over network interconnections into one large, parallel network file system. Security Fix(es) : * glusterfs: Unsanitized file names in debug/io-stats translator can allow remote attackers to execute arbitrary code (CVE-2018-10904) * glusterfs: Stack-based buffer overflow in server-rpc-fops.c allows remote attackers to execute arbitrary code (CVE-2018-10907) * glusterfs: I/O to arbitrary devices on storage server (CVE-2018-10923) * glusterfs: Device files can be created in arbitrary locations (CVE-2018-10926) * glusterfs: File status information leak and denial of service (CVE-2018-10927) * glusterfs: Improper resolution of symlinks allows for privilege escalation (CVE-2018-10928) * glusterfs: Arbitrary file creation on storage server allows for execution of arbitrary code (CVE-2018-10929) * glusterfs: Files can be renamed outside volume (CVE-2018-10930) * glusterfs: Improper deserialization in dict.c:dict_unserialize() can allow attackers to read arbitrary memory (CVE-2018-10911) * glusterfs: remote denial of service of gluster volumes via posix_get_file_contents function in posix-helpers.c (CVE-2018-10914) * glusterfs: Information Exposure in posix_get_file_contents function in posix-helpers.c (CVE-2018-10913) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank Michael Hanselmann (hansmi.ch) for reporting these issues. Additional Changes : These updated glusterfs packages include numerous bug fixes and enhancements. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Gluster Storage 3.4 Release Notes for information on the most significant of these changes : https://access.redhat.com/site/documentation/en-US/red_hat_gluster_sto rage/3.4/ html/3.4_release_notes/ All users of Red Hat Gluster Storage are advised to upgrade to these updated packages, which provide numerous bug fixes and enhancements.
    last seen2020-06-01
    modified2020-06-02
    plugin id118982
    published2018-11-16
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/118982
    titleCentOS 7 : glusterfs (CESA-2018:2607)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2018:2607 and 
    # CentOS Errata and Security Advisory 2018:2607 respectively.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(118982);
      script_version("1.4");
      script_cvs_date("Date: 2019/12/31");
    
      script_cve_id("CVE-2018-10904", "CVE-2018-10907", "CVE-2018-10911", "CVE-2018-10913", "CVE-2018-10914", "CVE-2018-10923", "CVE-2018-10926", "CVE-2018-10927", "CVE-2018-10928", "CVE-2018-10929", "CVE-2018-10930");
      script_xref(name:"RHSA", value:"2018:2607");
    
      script_name(english:"CentOS 7 : glusterfs (CESA-2018:2607)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote CentOS host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Updated glusterfs packages that fix multiple security issues and bugs,
    and add various enhancements are now available for Red Hat Gluster
    Storage 3.4 on Red Hat Enterprise Linux 7.
    
    Red Hat Product Security has rated this update as having a security
    impact of Important. A Common Vulnerability Scoring System (CVSS) base
    score, which gives a detailed severity rating, is available for each
    vulnerability from the CVE link(s) in the References section.
    
    GlusterFS is a key building block of Red Hat Gluster Storage. It is
    based on a stackable user-space design and can deliver exceptional
    performance for diverse workloads. GlusterFS aggregates various
    storage servers over network interconnections into one large, parallel
    network file system.
    
    Security Fix(es) :
    
    * glusterfs: Unsanitized file names in debug/io-stats translator can
    allow remote attackers to execute arbitrary code (CVE-2018-10904)
    
    * glusterfs: Stack-based buffer overflow in server-rpc-fops.c allows
    remote attackers to execute arbitrary code (CVE-2018-10907)
    
    * glusterfs: I/O to arbitrary devices on storage server
    (CVE-2018-10923)
    
    * glusterfs: Device files can be created in arbitrary locations
    (CVE-2018-10926)
    
    * glusterfs: File status information leak and denial of service
    (CVE-2018-10927)
    
    * glusterfs: Improper resolution of symlinks allows for privilege
    escalation (CVE-2018-10928)
    
    * glusterfs: Arbitrary file creation on storage server allows for
    execution of arbitrary code (CVE-2018-10929)
    
    * glusterfs: Files can be renamed outside volume (CVE-2018-10930)
    
    * glusterfs: Improper deserialization in dict.c:dict_unserialize() can
    allow attackers to read arbitrary memory (CVE-2018-10911)
    
    * glusterfs: remote denial of service of gluster volumes via
    posix_get_file_contents function in posix-helpers.c (CVE-2018-10914)
    
    * glusterfs: Information Exposure in posix_get_file_contents function
    in posix-helpers.c (CVE-2018-10913)
    
    For more details about the security issue(s), including the impact, a
    CVSS score, and other related information, refer to the CVE page(s)
    listed in the References section.
    
    Red Hat would like to thank Michael Hanselmann (hansmi.ch) for
    reporting these issues.
    
    Additional Changes :
    
    These updated glusterfs packages include numerous bug fixes and
    enhancements. Space precludes documenting all of these changes in this
    advisory. Users are directed to the Red Hat Gluster Storage 3.4
    Release Notes for information on the most significant of these 
    changes :
    
    https://access.redhat.com/site/documentation/en-US/red_hat_gluster_sto
    rage/3.4/ html/3.4_release_notes/
    
    All users of Red Hat Gluster Storage are advised to upgrade to these
    updated packages, which provide numerous bug fixes and enhancements."
      );
      # https://lists.centos.org/pipermail/centos-cr-announce/2018-November/005411.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?12b2bbf4"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected glusterfs packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-10904");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:glusterfs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:glusterfs-api");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:glusterfs-api-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:glusterfs-cli");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:glusterfs-client-xlators");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:glusterfs-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:glusterfs-fuse");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:glusterfs-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:glusterfs-rdma");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:python2-gluster");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:centos:centos:7");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/09/04");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/11/15");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/11/16");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"CentOS Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/CentOS/release");
    if (isnull(release) || "CentOS" >!< release) audit(AUDIT_OS_NOT, "CentOS");
    os_ver = pregmatch(pattern: "CentOS(?: Linux)? release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "CentOS");
    os_ver = os_ver[1];
    if (! preg(pattern:"^7([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "CentOS 7.x", "CentOS " + os_ver);
    
    if (!get_kb_item("Host/CentOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "CentOS", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"glusterfs-3.12.2-18.el7")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"glusterfs-api-3.12.2-18.el7")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"glusterfs-api-devel-3.12.2-18.el7")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"glusterfs-cli-3.12.2-18.el7")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"glusterfs-client-xlators-3.12.2-18.el7")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"glusterfs-devel-3.12.2-18.el7")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"glusterfs-fuse-3.12.2-18.el7")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"glusterfs-libs-3.12.2-18.el7")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"glusterfs-rdma-3.12.2-18.el7")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"python2-gluster-3.12.2-18.el7")) flag++;
    
    
    if (flag)
    {
      cr_plugin_caveat = '\n' +
        'NOTE: The security advisory associated with this vulnerability has a\n' +
        'fixed package version that may only be available in the continuous\n' +
        'release (CR) repository for CentOS, until it is present in the next\n' +
        'point release of CentOS.\n\n' +
    
        'If an equal or higher package level does not exist in the baseline\n' +
        'repository for your major version of CentOS, then updates from the CR\n' +
        'repository will need to be applied in order to address the\n' +
        'vulnerability.\n';
      security_report_v4(
        port       : 0,
        severity   : SECURITY_WARNING,
        extra      : rpm_report_get() + cr_plugin_caveat
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "glusterfs / glusterfs-api / glusterfs-api-devel / glusterfs-cli / etc");
    }
    
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2018-2607.NASL
    descriptionUpdated glusterfs packages that fix multiple security issues and bugs, and add various enhancements are now available for Red Hat Gluster Storage 3.4 on Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. GlusterFS is a key building block of Red Hat Gluster Storage. It is based on a stackable user-space design and can deliver exceptional performance for diverse workloads. GlusterFS aggregates various storage servers over network interconnections into one large, parallel network file system. Security Fix(es) : * glusterfs: Unsanitized file names in debug/io-stats translator can allow remote attackers to execute arbitrary code (CVE-2018-10904) * glusterfs: Stack-based buffer overflow in server-rpc-fops.c allows remote attackers to execute arbitrary code (CVE-2018-10907) * glusterfs: I/O to arbitrary devices on storage server (CVE-2018-10923) * glusterfs: Device files can be created in arbitrary locations (CVE-2018-10926) * glusterfs: File status information leak and denial of service (CVE-2018-10927) * glusterfs: Improper resolution of symlinks allows for privilege escalation (CVE-2018-10928) * glusterfs: Arbitrary file creation on storage server allows for execution of arbitrary code (CVE-2018-10929) * glusterfs: Files can be renamed outside volume (CVE-2018-10930) * glusterfs: Improper deserialization in dict.c:dict_unserialize() can allow attackers to read arbitrary memory (CVE-2018-10911) * glusterfs: remote denial of service of gluster volumes via posix_get_file_contents function in posix-helpers.c (CVE-2018-10914) * glusterfs: Information Exposure in posix_get_file_contents function in posix-helpers.c (CVE-2018-10913) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank Michael Hanselmann (hansmi.ch) for reporting these issues. Additional Changes : These updated glusterfs packages include numerous bug fixes and enhancements. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Gluster Storage 3.4 Release Notes for information on the most significant of these changes : https://access.redhat.com/site/documentation/en-US/red_hat_gluster_sto rage/3.4/ html/3.4_release_notes/ All users of Red Hat Gluster Storage are advised to upgrade to these updated packages, which provide numerous bug fixes and enhancements.
    last seen2020-06-01
    modified2020-06-02
    plugin id117317
    published2018-09-06
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/117317
    titleRHEL 7 : Gluster Storage (RHSA-2018:2607)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2018:2607. The text 
    # itself is copyright (C) Red Hat, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(117317);
      script_version("1.6");
      script_cvs_date("Date: 2019/10/24 15:35:45");
    
      script_cve_id("CVE-2018-10904", "CVE-2018-10907", "CVE-2018-10911", "CVE-2018-10913", "CVE-2018-10914", "CVE-2018-10923", "CVE-2018-10926", "CVE-2018-10927", "CVE-2018-10928", "CVE-2018-10929", "CVE-2018-10930");
      script_xref(name:"RHSA", value:"2018:2607");
    
      script_name(english:"RHEL 7 : Gluster Storage (RHSA-2018:2607)");
      script_summary(english:"Checks the rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Red Hat host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Updated glusterfs packages that fix multiple security issues and bugs,
    and add various enhancements are now available for Red Hat Gluster
    Storage 3.4 on Red Hat Enterprise Linux 7.
    
    Red Hat Product Security has rated this update as having a security
    impact of Important. A Common Vulnerability Scoring System (CVSS) base
    score, which gives a detailed severity rating, is available for each
    vulnerability from the CVE link(s) in the References section.
    
    GlusterFS is a key building block of Red Hat Gluster Storage. It is
    based on a stackable user-space design and can deliver exceptional
    performance for diverse workloads. GlusterFS aggregates various
    storage servers over network interconnections into one large, parallel
    network file system.
    
    Security Fix(es) :
    
    * glusterfs: Unsanitized file names in debug/io-stats translator can
    allow remote attackers to execute arbitrary code (CVE-2018-10904)
    
    * glusterfs: Stack-based buffer overflow in server-rpc-fops.c allows
    remote attackers to execute arbitrary code (CVE-2018-10907)
    
    * glusterfs: I/O to arbitrary devices on storage server
    (CVE-2018-10923)
    
    * glusterfs: Device files can be created in arbitrary locations
    (CVE-2018-10926)
    
    * glusterfs: File status information leak and denial of service
    (CVE-2018-10927)
    
    * glusterfs: Improper resolution of symlinks allows for privilege
    escalation (CVE-2018-10928)
    
    * glusterfs: Arbitrary file creation on storage server allows for
    execution of arbitrary code (CVE-2018-10929)
    
    * glusterfs: Files can be renamed outside volume (CVE-2018-10930)
    
    * glusterfs: Improper deserialization in dict.c:dict_unserialize() can
    allow attackers to read arbitrary memory (CVE-2018-10911)
    
    * glusterfs: remote denial of service of gluster volumes via
    posix_get_file_contents function in posix-helpers.c (CVE-2018-10914)
    
    * glusterfs: Information Exposure in posix_get_file_contents function
    in posix-helpers.c (CVE-2018-10913)
    
    For more details about the security issue(s), including the impact, a
    CVSS score, and other related information, refer to the CVE page(s)
    listed in the References section.
    
    Red Hat would like to thank Michael Hanselmann (hansmi.ch) for
    reporting these issues.
    
    Additional Changes :
    
    These updated glusterfs packages include numerous bug fixes and
    enhancements. Space precludes documenting all of these changes in this
    advisory. Users are directed to the Red Hat Gluster Storage 3.4
    Release Notes for information on the most significant of these 
    changes :
    
    https://access.redhat.com/site/documentation/en-US/red_hat_gluster_sto
    rage/3.4/ html/3.4_release_notes/
    
    All users of Red Hat Gluster Storage are advised to upgrade to these
    updated packages, which provide numerous bug fixes and enhancements."
      );
      # https://access.redhat.com/site/documentation/en-US/red_hat_gluster_storage/
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?d6c2aef9"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/errata/RHSA-2018:2607"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-10904"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-10907"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-10911"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-10913"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-10914"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-10923"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-10926"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-10927"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-10928"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-10929"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-10930"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:glusterfs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:glusterfs-api");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:glusterfs-api-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:glusterfs-cli");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:glusterfs-client-xlators");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:glusterfs-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:glusterfs-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:glusterfs-events");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:glusterfs-fuse");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:glusterfs-ganesha");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:glusterfs-geo-replication");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:glusterfs-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:glusterfs-rdma");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:glusterfs-resource-agents");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:glusterfs-server");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python2-gluster");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:redhat-release-server");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:redhat-storage-server");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/09/04");
      script_set_attribute(attribute:"patch_publication_date", value:"2019/01/07");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/09/06");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Red Hat Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
    os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
    os_ver = os_ver[1];
    if (! preg(pattern:"^7([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 7.x", "Red Hat " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);
    
    yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
    if (!empty_or_null(yum_updateinfo)) 
    {
      rhsa = "RHSA-2018:2607";
      yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
      if (!empty_or_null(yum_report))
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_WARNING,
          extra      : yum_report 
        );
        exit(0);
      }
      else
      {
        audit_message = "affected by Red Hat security advisory " + rhsa;
        audit(AUDIT_OS_NOT, audit_message);
      }
    }
    else
    {
      flag = 0;
    
      if (! (rpm_exists(release:"RHEL7", rpm:"glusterfs-3.12.2"))) audit(AUDIT_PACKAGE_NOT_INSTALLED, "Gluster Storage");
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"glusterfs-3.12.2-18.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"glusterfs-api-3.12.2-18.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"glusterfs-api-devel-3.12.2-18.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"glusterfs-cli-3.12.2-18.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"glusterfs-client-xlators-3.12.2-18.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"glusterfs-debuginfo-3.12.2-18.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"glusterfs-devel-3.12.2-18.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"glusterfs-events-3.12.2-18.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"glusterfs-fuse-3.12.2-18.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"glusterfs-ganesha-3.12.2-18.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"glusterfs-geo-replication-3.12.2-18.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"glusterfs-libs-3.12.2-18.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"glusterfs-rdma-3.12.2-18.el7")) flag++;
      if (rpm_check(release:"RHEL7", reference:"glusterfs-resource-agents-3.12.2-18.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"glusterfs-server-3.12.2-18.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"python2-gluster-3.12.2-18.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"redhat-release-server-7.5-11.el7")) flag++;
      if (rpm_check(release:"RHEL7", reference:"redhat-storage-server-3.4.0.0-1.el7")) flag++;
    
      if (flag)
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_WARNING,
          extra      : rpm_report_get() + redhat_report_package_caveat()
        );
        exit(0);
      }
      else
      {
        tested = pkg_tests_get();
        if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
        else audit(AUDIT_PACKAGE_NOT_INSTALLED, "glusterfs / glusterfs-api / glusterfs-api-devel / glusterfs-cli / etc");
      }
    }
    
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2018-9A4D7EC61E.NASL
    description3.12.14 GA Security Fix for CVE-2018-10904 Security Fix for CVE-2018-10907 Security Fix for CVE-2018-10911 Security Fix for CVE-2018-10913 Security Fix for CVE-2018-10914 Security Fix for CVE-2018-10923 Security Fix for CVE-2018-10926 Security Fix for CVE-2018-10927 Security Fix for CVE-2018-10928 Security Fix for CVE-2018-10929 Security Fix for CVE-2018-10930 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2018-10-01
    plugin id117841
    published2018-10-01
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/117841
    titleFedora 27 : glusterfs (2018-9a4d7ec61e)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Fedora Security Advisory FEDORA-2018-9a4d7ec61e.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(117841);
      script_version("1.4");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2018-10904", "CVE-2018-10907", "CVE-2018-10911", "CVE-2018-10913", "CVE-2018-10914", "CVE-2018-10923", "CVE-2018-10926", "CVE-2018-10927", "CVE-2018-10928", "CVE-2018-10929", "CVE-2018-10930");
      script_xref(name:"FEDORA", value:"2018-9a4d7ec61e");
    
      script_name(english:"Fedora 27 : glusterfs (2018-9a4d7ec61e)");
      script_summary(english:"Checks rpm output for the updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Fedora host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "3.12.14 GA Security Fix for CVE-2018-10904 Security Fix for
    CVE-2018-10907 Security Fix for CVE-2018-10911 Security Fix for
    CVE-2018-10913 Security Fix for CVE-2018-10914 Security Fix for
    CVE-2018-10923 Security Fix for CVE-2018-10926 Security Fix for
    CVE-2018-10927 Security Fix for CVE-2018-10928 Security Fix for
    CVE-2018-10929 Security Fix for CVE-2018-10930
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Fedora update system website.
    Tenable has attempted to automatically clean and format it as much as
    possible without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bodhi.fedoraproject.org/updates/FEDORA-2018-9a4d7ec61e"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected glusterfs package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:glusterfs");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:27");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/09/04");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/09/28");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/10/01");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Fedora Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
    os_ver = pregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
    os_ver = os_ver[1];
    if (! preg(pattern:"^27([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 27", "Fedora " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"FC27", reference:"glusterfs-3.12.14-1.fc27")) flag++;
    
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_WARNING,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "glusterfs");
    }
    
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2020-1103.NASL
    descriptionAccording to the versions of the glusterfs packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in RPC request using gfs2_create_req in glusterfs server. An authenticated attacker could use this flaw to create arbitrary files and execute arbitrary code on glusterfs server nodes.(CVE-2018-10929) - A flaw was found in RPC request using gfs3_lookup_req in glusterfs server. An authenticated attacker could use this flaw to leak information and execute remote denial of service by crashing gluster brick process.(CVE-2018-10927) - A flaw was found in RPC request using gfs3_mknod_req supported by glusterfs server. An authenticated attacker could use this flaw to write files to an arbitrary location via path traversal and execute arbitrary code on a glusterfs server node.(CVE-2018-10926) - A flaw was found in RPC request using gfs3_rename_req in glusterfs server. An authenticated attacker could use this flaw to write to a destination outside the gluster volume.(CVE-2018-10930) - A flaw was found in RPC request using gfs3_symlink_req in glusterfs server which allows symlink destinations to point to file paths outside of the gluster volume. An authenticated attacker could use this flaw to create arbitrary symlinks pointing anywhere on the server and execute arbitrary code on glusterfs server nodes.(CVE-2018-10928) - It was found that glusterfs server does not properly sanitize file paths in the
    last seen2020-05-06
    modified2020-02-24
    plugin id133904
    published2020-02-24
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/133904
    titleEulerOS 2.0 SP5 : glusterfs (EulerOS-SA-2020-1103)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(133904);
      script_version("1.4");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/04");
    
      script_cve_id(
        "CVE-2018-10904",
        "CVE-2018-10907",
        "CVE-2018-10913",
        "CVE-2018-10914",
        "CVE-2018-10923",
        "CVE-2018-10926",
        "CVE-2018-10927",
        "CVE-2018-10928",
        "CVE-2018-10929",
        "CVE-2018-10930"
      );
    
      script_name(english:"EulerOS 2.0 SP5 : glusterfs (EulerOS-SA-2020-1103)");
      script_summary(english:"Checks the rpm output for the updated packages.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote EulerOS host is missing multiple security updates.");
      script_set_attribute(attribute:"description", value:
    "According to the versions of the glusterfs packages installed, the
    EulerOS installation on the remote host is affected by the following
    vulnerabilities :
    
      - A flaw was found in RPC request using gfs2_create_req
        in glusterfs server. An authenticated attacker could
        use this flaw to create arbitrary files and execute
        arbitrary code on glusterfs server
        nodes.(CVE-2018-10929)
    
      - A flaw was found in RPC request using gfs3_lookup_req
        in glusterfs server. An authenticated attacker could
        use this flaw to leak information and execute remote
        denial of service by crashing gluster brick
        process.(CVE-2018-10927)
    
      - A flaw was found in RPC request using gfs3_mknod_req
        supported by glusterfs server. An authenticated
        attacker could use this flaw to write files to an
        arbitrary location via path traversal and execute
        arbitrary code on a glusterfs server
        node.(CVE-2018-10926)
    
      - A flaw was found in RPC request using gfs3_rename_req
        in glusterfs server. An authenticated attacker could
        use this flaw to write to a destination outside the
        gluster volume.(CVE-2018-10930)
    
      - A flaw was found in RPC request using gfs3_symlink_req
        in glusterfs server which allows symlink destinations
        to point to file paths outside of the gluster volume.
        An authenticated attacker could use this flaw to create
        arbitrary symlinks pointing anywhere on the server and
        execute arbitrary code on glusterfs server
        nodes.(CVE-2018-10928)
    
      - It was found that glusterfs server does not properly
        sanitize file paths in the 'trusted.io-stats-dump'
        extended attribute which is used by the
        'debug/io-stats' translator. Attacker can use this flaw
        to create files and execute arbitrary code. To exploit
        this attacker would require sufficient access to modify
        the extended attributes of files on a gluster
        volume.(CVE-2018-10904)
    
      - It was found that glusterfs server is vulnerable to
        multiple stack based buffer overflows due to functions
        in server-rpc-fopc.c allocating fixed size buffers
        using 'alloca(3)'. An authenticated attacker could
        exploit this by mounting a gluster volume and sending a
        string longer that the fixed buffer size to cause crash
        or potential code execution.(CVE-2018-10907)
    
      - An information disclosure vulnerability was discovered
        in glusterfs server. An attacker could issue a xattr
        request via glusterfs FUSE to determine the existence
        of any file.(CVE-2018-10913)
    
      - It was found that an attacker could issue a xattr
        request via glusterfs FUSE to cause gluster brick
        process to crash which will result in a remote denial
        of service. If gluster multiplexing is enabled this
        will result in a crash of multiple bricks and gluster
        volumes.(CVE-2018-10914)
    
      - It was found that the 'mknod' call derived from
        mknod(2) can create files pointing to devices on a
        glusterfs server node. An authenticated attacker could
        use this to create an arbitrary device and read data
        from any device attached to the glusterfs server
        node.(CVE-2018-10923)
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the EulerOS security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues.");
      # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2020-1103
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5df7eb52");
      script_set_attribute(attribute:"solution", value:
    "Update the affected glusterfs packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2020/02/21");
      script_set_attribute(attribute:"plugin_publication_date", value:"2020/02/24");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:glusterfs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:glusterfs-api");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:glusterfs-client-xlators");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:glusterfs-fuse");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:glusterfs-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:glusterfs-rdma");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Huawei Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
      script_exclude_keys("Host/EulerOS/uvp_version");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    release = get_kb_item("Host/EulerOS/release");
    if (isnull(release) || release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
    if (release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0");
    
    sp = get_kb_item("Host/EulerOS/sp");
    if (isnull(sp) || sp !~ "^(5)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP5");
    
    uvp = get_kb_item("Host/EulerOS/uvp_version");
    if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP5", "EulerOS UVP " + uvp);
    
    if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu);
    
    flag = 0;
    
    pkgs = ["glusterfs-3.8.4-54.15.h6.eulerosv2r7",
            "glusterfs-api-3.8.4-54.15.h6.eulerosv2r7",
            "glusterfs-client-xlators-3.8.4-54.15.h6.eulerosv2r7",
            "glusterfs-fuse-3.8.4-54.15.h6.eulerosv2r7",
            "glusterfs-libs-3.8.4-54.15.h6.eulerosv2r7",
            "glusterfs-rdma-3.8.4-54.15.h6.eulerosv2r7"];
    
    foreach (pkg in pkgs)
      if (rpm_check(release:"EulerOS-2.0", sp:"5", reference:pkg)) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_WARNING,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "glusterfs");
    }
    
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2018-A54270A213.NASL
    description4.1.5 GA ---- 4.1.4 GA Security Fix for CVE-2018-10904 Security Fix for CVE-2018-10907 Security Fix for CVE-2018-10911 Security Fix for CVE-2018-10913 Security Fix for CVE-2018-10914 Security Fix for CVE-2018-10923 Security Fix for CVE-2018-10926 Security Fix for CVE-2018-10927 Security Fix for CVE-2018-10928 Security Fix for CVE-2018-10929 Security Fix for CVE-2018-10930 ---- missing /run/gluster/metrics, see bz#1624006 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2019-01-03
    plugin id120672
    published2019-01-03
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/120672
    titleFedora 29 : glusterfs (2018-a54270a213)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Fedora Security Advisory FEDORA-2018-a54270a213.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(120672);
      script_version("1.4");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2018-10904", "CVE-2018-10907", "CVE-2018-10911", "CVE-2018-10913", "CVE-2018-10914", "CVE-2018-10923", "CVE-2018-10926", "CVE-2018-10927", "CVE-2018-10928", "CVE-2018-10929", "CVE-2018-10930");
      script_xref(name:"FEDORA", value:"2018-a54270a213");
    
      script_name(english:"Fedora 29 : glusterfs (2018-a54270a213)");
      script_summary(english:"Checks rpm output for the updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Fedora host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "4.1.5 GA
    
    ----
    
    4.1.4 GA Security Fix for CVE-2018-10904 Security Fix for
    CVE-2018-10907 Security Fix for CVE-2018-10911 Security Fix for
    CVE-2018-10913 Security Fix for CVE-2018-10914 Security Fix for
    CVE-2018-10923 Security Fix for CVE-2018-10926 Security Fix for
    CVE-2018-10927 Security Fix for CVE-2018-10928 Security Fix for
    CVE-2018-10929 Security Fix for CVE-2018-10930
    
    ----
    
    missing /run/gluster/metrics, see bz#1624006
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Fedora update system website.
    Tenable has attempted to automatically clean and format it as much as
    possible without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bodhi.fedoraproject.org/updates/FEDORA-2018-a54270a213"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected glusterfs package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:glusterfs");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:29");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/09/04");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/10/02");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/01/03");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Fedora Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
    os_ver = pregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
    os_ver = os_ver[1];
    if (! preg(pattern:"^29([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 29", "Fedora " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"FC29", reference:"glusterfs-4.1.5-1.fc29")) flag++;
    
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_WARNING,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "glusterfs");
    }
    
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2018-3470.NASL
    descriptionAn update for imgbased, redhat-release-virtualization-host, and redhat-virtualization-host is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host
    last seen2020-06-01
    modified2020-06-02
    plugin id118790
    published2018-11-07
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/118790
    titleRHEL 7 : Virtualization Manager (RHSA-2018:3470)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2018:3470. The text 
    # itself is copyright (C) Red Hat, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(118790);
      script_version("1.7");
      script_cvs_date("Date: 2019/10/24 15:35:46");
    
      script_cve_id("CVE-2018-1000805", "CVE-2018-10858", "CVE-2018-10873", "CVE-2018-10904", "CVE-2018-10907", "CVE-2018-10911", "CVE-2018-10913", "CVE-2018-10914", "CVE-2018-10923", "CVE-2018-10926", "CVE-2018-10927", "CVE-2018-10928", "CVE-2018-10929", "CVE-2018-10930", "CVE-2018-14652", "CVE-2018-14653", "CVE-2018-14654", "CVE-2018-14659", "CVE-2018-14660", "CVE-2018-14661");
      script_xref(name:"RHSA", value:"2018:3470");
    
      script_name(english:"RHEL 7 : Virtualization Manager (RHSA-2018:3470)");
      script_summary(english:"Checks the rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Red Hat host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "An update for imgbased, redhat-release-virtualization-host, and
    redhat-virtualization-host is now available for Red Hat Virtualization
    4 for Red Hat Enterprise Linux 7.
    
    Red Hat Product Security has rated this update as having a security
    impact of Moderate. A Common Vulnerability Scoring System (CVSS) base
    score, which gives a detailed severity rating, is available for each
    vulnerability from the CVE link(s) in the References section.
    
    The redhat-virtualization-host packages provide the Red Hat
    Virtualization Host. These packages include
    redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor.
    Red Hat Virtualization Hosts (RHVH) are installed using a special
    build of Red Hat Enterprise Linux with only the packages required to
    host virtual machines. RHVH features a Cockpit user interface for
    monitoring the host's resources and performing administrative tasks.
    
    Security Fix(es) :
    
    * spice: Missing check in demarshal.py:write_validate_array_item()
    allows for buffer overflow and denial of service (CVE-2018-10873)
    
    * glusterfs: Multiple flaws (CVE-2018-10904, CVE-2018-10907,
    CVE-2018-10923, CVE-2018-10926, CVE-2018-10927, CVE-2018-10928,
    CVE-2018-10929, CVE-2018-10930, CVE-2018-10911, CVE-2018-10914,
    CVE-2018-14652, CVE-2018-14653, CVE-2018-14654, CVE-2018-14659,
    CVE-2018-14660, CVE-2018-14661, CVE-2018-10913)
    
    * samba: Insufficient input validation in libsmbclient
    (CVE-2018-10858)
    
    For more details about the security issue(s), including the impact, a
    CVSS score, and other related information, refer to the CVE page(s)
    listed in the References section.
    
    Red Hat would like to thank Michael Hanselmann (hansmi.ch) for
    reporting CVE-2018-10904, CVE-2018-10907, CVE-2018-10923,
    CVE-2018-10926, CVE-2018-10927, CVE-2018-10928, CVE-2018-10929,
    CVE-2018-10930, CVE-2018-10911, CVE-2018-10914, CVE-2018-14652,
    CVE-2018-14653, CVE-2018-14654, CVE-2018-14659, CVE-2018-14660,
    CVE-2018-14661, and CVE-2018-10913. The CVE-2018-10873 issue was
    discovered by Frediano Ziglio (Red Hat).
    
    Bug Fix(es) :
    
    * When upgrading Red Hat Virtualization Host (RHVH), imgbased fails to
    run garbage collection on previous layers, so new logical volumes are
    removed, and the boot entry points to a logical volume that was
    removed.
    
    If the RHVH upgrade finishes successfully, the hypervisor boots
    successfully, even if garbage collection fails. (BZ#1632058)
    
    * During the upgrade process, when lvremove runs garbage collection,
    it prompts for user confirmation, causing the upgrade process to fail.
    Now the process uses 'lvremove --force' when trying to remove logical
    volumes and does not fail even if garbage collection fails, and as a
    result, the upgrade process finishes successfully. (BZ#1632585)"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/errata/RHSA-2018:3470"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-10858"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-10873"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-10904"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-10907"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-10911"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-10913"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-10914"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-10923"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-10926"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-10927"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-10928"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-10929"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-10930"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-14652"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-14653"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-14654"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-14659"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-14660"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-14661"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-1000805"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:N/I:C/A:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:imgbased");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-imgbased");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:redhat-release-virtualization-host");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:redhat-virtualization-host-image-update");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:redhat-virtualization-host-image-update-placeholder");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/08/17");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/11/05");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/11/07");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Red Hat Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
    os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
    os_ver = os_ver[1];
    if (! preg(pattern:"^7([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 7.x", "Red Hat " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);
    
    yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
    if (!empty_or_null(yum_updateinfo)) 
    {
      rhsa = "RHSA-2018:3470";
      yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
      if (!empty_or_null(yum_report))
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : yum_report 
        );
        exit(0);
      }
      else
      {
        audit_message = "affected by Red Hat security advisory " + rhsa;
        audit(AUDIT_OS_NOT, audit_message);
      }
    }
    else
    {
      flag = 0;
    
      if (! (rpm_exists(release:"RHEL7", rpm:"redhat-release-virtualization-host-4.2"))) audit(AUDIT_PACKAGE_NOT_INSTALLED, "Red Hat Virtualization 4");
    
      if (rpm_check(release:"RHEL7", reference:"imgbased-1.0.29-1.el7")) flag++;
      if (rpm_check(release:"RHEL7", reference:"python-imgbased-1.0.29-1.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"redhat-release-virtualization-host-4.2-7.3.el7")) flag++;
      if (rpm_check(release:"RHEL7", reference:"redhat-virtualization-host-image-update-4.2-20181026.0.el7_6")) flag++;
      if (rpm_check(release:"RHEL7", reference:"redhat-virtualization-host-image-update-placeholder-4.2-7.3.el7")) flag++;
    
      if (flag)
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : rpm_report_get() + redhat_report_package_caveat()
        );
        exit(0);
      }
      else
      {
        tested = pkg_tests_get();
        if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
        else audit(AUDIT_PACKAGE_NOT_INSTALLED, "imgbased / python-imgbased / redhat-release-virtualization-host / etc");
      }
    }
    
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2018-4E660226E7.NASL
    description4.1.4 GA Security Fix for CVE-2018-10904 Security Fix for CVE-2018-10907 Security Fix for CVE-2018-10911 Security Fix for CVE-2018-10913 Security Fix for CVE-2018-10914 Security Fix for CVE-2018-10923 Security Fix for CVE-2018-10926 Security Fix for CVE-2018-10927 Security Fix for CVE-2018-10928 Security Fix for CVE-2018-10929 Security Fix for CVE-2018-10930 ---- missing /run/gluster/metrics, see bz#1624006 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2019-01-03
    plugin id120410
    published2019-01-03
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/120410
    titleFedora 28 : glusterfs (2018-4e660226e7)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Fedora Security Advisory FEDORA-2018-4e660226e7.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(120410);
      script_version("1.4");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2018-10904", "CVE-2018-10907", "CVE-2018-10911", "CVE-2018-10913", "CVE-2018-10914", "CVE-2018-10923", "CVE-2018-10926", "CVE-2018-10927", "CVE-2018-10928", "CVE-2018-10929", "CVE-2018-10930");
      script_xref(name:"FEDORA", value:"2018-4e660226e7");
    
      script_name(english:"Fedora 28 : glusterfs (2018-4e660226e7)");
      script_summary(english:"Checks rpm output for the updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Fedora host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "4.1.4 GA Security Fix for CVE-2018-10904 Security Fix for
    CVE-2018-10907 Security Fix for CVE-2018-10911 Security Fix for
    CVE-2018-10913 Security Fix for CVE-2018-10914 Security Fix for
    CVE-2018-10923 Security Fix for CVE-2018-10926 Security Fix for
    CVE-2018-10927 Security Fix for CVE-2018-10928 Security Fix for
    CVE-2018-10929 Security Fix for CVE-2018-10930
    
    ----
    
    missing /run/gluster/metrics, see bz#1624006
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Fedora update system website.
    Tenable has attempted to automatically clean and format it as much as
    possible without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bodhi.fedoraproject.org/updates/FEDORA-2018-4e660226e7"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected glusterfs package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:glusterfs");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:28");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/09/04");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/09/11");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/01/03");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Fedora Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
    os_ver = pregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
    os_ver = os_ver[1];
    if (! preg(pattern:"^28([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 28", "Fedora " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"FC28", reference:"glusterfs-4.1.4-1.fc28")) flag++;
    
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_WARNING,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "glusterfs");
    }
    
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2018-2608.NASL
    descriptionUpdated glusterfs packages that fix multiple security issues, several bugs, and adds various enhancements are now available for Red Hat Gluster Storage 3.4 on Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. GlusterFS is a key building block of Red Hat Gluster Storage. It is based on a stackable user-space design and can deliver exceptional performance for diverse workloads. GlusterFS aggregates various storage servers over network interconnections into one large, parallel network file system. Security Fix(es) : * glusterfs: Unsanitized file names in debug/io-stats translator can allow remote attackers to execute arbitrary code (CVE-2018-10904) * glusterfs: Stack-based buffer overflow in server-rpc-fops.c allows remote attackers to execute arbitrary code (CVE-2018-10907) * glusterfs: I/O to arbitrary devices on storage server (CVE-2018-10923) * glusterfs: Device files can be created in arbitrary locations (CVE-2018-10926) * glusterfs: File status information leak and denial of service (CVE-2018-10927) * glusterfs: Improper resolution of symlinks allows for privilege escalation (CVE-2018-10928) * glusterfs: Arbitrary file creation on storage server allows for execution of arbitrary code (CVE-2018-10929) * glusterfs: Files can be renamed outside volume (CVE-2018-10930) * glusterfs: Improper deserialization in dict.c:dict_unserialize() can allow attackers to read arbitrary memory (CVE-2018-10911) * glusterfs: remote denial of service of gluster volumes via posix_get_file_contents function in posix-helpers.c (CVE-2018-10914) * glusterfs: Information Exposure in posix_get_file_contents function in posix-helpers.c (CVE-2018-10913) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank Michael Hanselmann (hansmi.ch) for reporting these issues. Additional changes : These updated Red Hat Gluster Storage packages include numerous bug fixes and enhancements. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Gluster Storage 3.4 Release Notes for information on the most significant of these changes : https://access.redhat.com/documentation/en-us/red_hat_gluster_storage/ 3.4/html/ 3.4_release_notes/ All users of Red Hat Gluster Storage are advised to upgrade to these updated packages, which provide numerous bug fixes and enhancements. Disabled on 2018/11/06. Detection of Gluster Storage Server on RHEL 6 is no longer possible due to changes in Gluster package versioning.
    last seen2019-02-21
    modified2018-11-07
    plugin id117318
    published2018-09-06
    reporterTenable
    sourcehttps://www.tenable.com/plugins/index.php?view=single&id=117318
    titleRHEL 6 : Gluster Storage (RHSA-2018:2608) (deprecated)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2020-1525.NASL
    descriptionAccording to the versions of the glusterfs packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - A flaw was found in RPC request using gfs3_rename_req in glusterfs server. An authenticated attacker could use this flaw to write to a destination outside the gluster volume.(CVE-2018-10930) - A flaw was found in RPC request using gfs2_create_req in glusterfs server. An authenticated attacker could use this flaw to create arbitrary files and execute arbitrary code on glusterfs server nodes.(CVE-2018-10929) - A flaw was found in RPC request using gfs3_symlink_req in glusterfs server which allows symlink destinations to point to file paths outside of the gluster volume. An authenticated attacker could use this flaw to create arbitrary symlinks pointing anywhere on the server and execute arbitrary code on glusterfs server nodes.(CVE-2018-10928) - A flaw was found in RPC request using gfs3_lookup_req in glusterfs server. An authenticated attacker could use this flaw to leak information and execute remote denial of service by crashing gluster brick process.(CVE-2018-10927) - A flaw was found in RPC request using gfs3_mknod_req supported by glusterfs server. An authenticated attacker could use this flaw to write files to an arbitrary location via path traversal and execute arbitrary code on a glusterfs server node.(CVE-2018-10926) - It was found that glusterfs server does not properly sanitize file paths in the
    last seen2020-05-08
    modified2020-05-01
    plugin id136228
    published2020-05-01
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/136228
    titleEulerOS Virtualization for ARM 64 3.0.2.0 : glusterfs (EulerOS-SA-2020-1525)
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201904-06.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201904-06 (GlusterFS: Multiple Vulnerabilities) Multiple vulnerabilities have been discovered in GlusterFS. Please review the referenced CVE identifiers for details. Impact : Please review the referenced CVE identifiers for details. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id123580
    published2019-04-02
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/123580
    titleGLSA-201904-06 : GlusterFS: Multiple Vulnerabilities
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2020-79.NASL
    descriptionThis update for glusterfs fixes the following issues : glusterfs was update to release 3.12.15 : - Fixed a number of bugs and security issues : - CVE-2018-1088, CVE-2018-1112 [boo#1090084], CVE-2018-10904 [boo#1107018], CVE-2018-10907 [boo#1107019], CVE-2018-10911 [boo#1107020], CVE-2018-10913 [boo#1107021], CVE-2018-10914 [boo#1107022], CVE-2018-10923 [boo#1107023], CVE-2018-10924 [boo#1107024], CVE-2018-10926 [boo#1107025], CVE-2018-10927 [boo#1107026], CVE-2018-10928 [boo#1107027], CVE-2018-10928 [boo#1107027], CVE-2018-10929 [boo#1107028], CVE-2018-10930 [boo#1107029], boo#1105776 .
    last seen2020-06-01
    modified2020-06-02
    plugin id133132
    published2020-01-21
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/133132
    titleopenSUSE Security Update : glusterfs (openSUSE-2020-79)

Redhat

advisories
  • rhsa
    idRHSA-2018:2607
  • rhsa
    idRHSA-2018:2608
  • rhsa
    idRHSA-2018:3470
rpms
  • glusterfs-0:3.12.2-18.el7
  • glusterfs-0:3.12.2-18.el7rhgs
  • glusterfs-api-0:3.12.2-18.el7
  • glusterfs-api-0:3.12.2-18.el7rhgs
  • glusterfs-api-devel-0:3.12.2-18.el7
  • glusterfs-api-devel-0:3.12.2-18.el7rhgs
  • glusterfs-cli-0:3.12.2-18.el7
  • glusterfs-cli-0:3.12.2-18.el7rhgs
  • glusterfs-client-xlators-0:3.12.2-18.el7
  • glusterfs-client-xlators-0:3.12.2-18.el7rhgs
  • glusterfs-debuginfo-0:3.12.2-18.el7
  • glusterfs-debuginfo-0:3.12.2-18.el7rhgs
  • glusterfs-devel-0:3.12.2-18.el7
  • glusterfs-devel-0:3.12.2-18.el7rhgs
  • glusterfs-events-0:3.12.2-18.el7rhgs
  • glusterfs-fuse-0:3.12.2-18.el7
  • glusterfs-fuse-0:3.12.2-18.el7rhgs
  • glusterfs-ganesha-0:3.12.2-18.el7rhgs
  • glusterfs-geo-replication-0:3.12.2-18.el7rhgs
  • glusterfs-libs-0:3.12.2-18.el7
  • glusterfs-libs-0:3.12.2-18.el7rhgs
  • glusterfs-rdma-0:3.12.2-18.el7
  • glusterfs-rdma-0:3.12.2-18.el7rhgs
  • glusterfs-resource-agents-0:3.12.2-18.el7rhgs
  • glusterfs-server-0:3.12.2-18.el7rhgs
  • python2-gluster-0:3.12.2-18.el7
  • python2-gluster-0:3.12.2-18.el7rhgs
  • redhat-release-server-0:7.5-11.el7rhgs
  • redhat-storage-server-0:3.4.0.0-1.el7rhgs
  • glusterfs-0:3.12.2-18.el6
  • glusterfs-0:3.12.2-18.el6rhs
  • glusterfs-api-0:3.12.2-18.el6
  • glusterfs-api-0:3.12.2-18.el6rhs
  • glusterfs-api-devel-0:3.12.2-18.el6
  • glusterfs-api-devel-0:3.12.2-18.el6rhs
  • glusterfs-cli-0:3.12.2-18.el6
  • glusterfs-cli-0:3.12.2-18.el6rhs
  • glusterfs-client-xlators-0:3.12.2-18.el6
  • glusterfs-client-xlators-0:3.12.2-18.el6rhs
  • glusterfs-debuginfo-0:3.12.2-18.el6
  • glusterfs-debuginfo-0:3.12.2-18.el6rhs
  • glusterfs-devel-0:3.12.2-18.el6
  • glusterfs-devel-0:3.12.2-18.el6rhs
  • glusterfs-events-0:3.12.2-18.el6rhs
  • glusterfs-fuse-0:3.12.2-18.el6
  • glusterfs-fuse-0:3.12.2-18.el6rhs
  • glusterfs-ganesha-0:3.12.2-18.el6rhs
  • glusterfs-geo-replication-0:3.12.2-18.el6rhs
  • glusterfs-libs-0:3.12.2-18.el6
  • glusterfs-libs-0:3.12.2-18.el6rhs
  • glusterfs-rdma-0:3.12.2-18.el6
  • glusterfs-rdma-0:3.12.2-18.el6rhs
  • glusterfs-server-0:3.12.2-18.el6rhs
  • python2-gluster-0:3.12.2-18.el6
  • python2-gluster-0:3.12.2-18.el6rhs
  • redhat-release-server-0:6Server-6.10.0.24.el6rhs
  • redhat-storage-server-0:3.4.0.0-1.el6rhs
  • imgbased-0:1.0.29-1.el7ev
  • python-imgbased-0:1.0.29-1.el7ev
  • redhat-release-virtualization-host-0:4.2-7.3.el7
  • redhat-virtualization-host-image-update-0:4.2-20181026.0.el7_6
  • redhat-virtualization-host-image-update-placeholder-0:4.2-7.3.el7