CVE-2018-10928
- State
- Published
- Severity
- 8.8 High
- Published
- Sep 4, 2018
- Updated
- Aug 5, 2024
- Reserved
- May 9, 2018
Description
A flaw was found in RPC request using gfs3_symlink_req in glusterfs server which allows symlink destinations to point to file paths outside of the gluster volume. An authenticated attacker could use this flaw to create arbitrary symlinks pointing anywhere on the server and execute arbitrary code on glusterfs server nodes.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 8.8 High | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | redhat |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
glusterfsRed Hat |
|
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10928
- RHSA-2018:2607vendor-advisory
- [debian-lts-announce] 20180920 [SECURITY] [DLA 1510-1] glusterfs security updatemailing-list
- RHSA-2018:2608vendor-advisory
- RHSA-2018:3470vendor-advisory
- GLSA-201904-06vendor-advisory
- openSUSE-SU-2020:0079vendor-advisory
- [debian-lts-announce] 20211101 [SECURITY] [DLA 2806-1] glusterfs security updatemailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.