A privilege escalation flaw was found in gluster 3.x snapshot scheduler. Any gluster client allowed to mount gluster volumes could also mount shared gluster storage volume and escalate privileges by scheduling malicious cronjob via symlink.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade glusterfs-server | Aug 28, 2019 | Apr 18, 2018 |
| Debian | — | Upgrade glusterfs | Feb 19, 2019 | Apr 18, 2018 |
| Gentoo Linux | — | Upgrade sys-cluster/glusterfs. | Apr 3, 2019 | Apr 18, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade glusterfs-client-xlatorsUpgrade glusterfs-rdmaUpgrade glusterfs-apiUpgrade glusterfs-fuseUpgrade glusterfs-libsUpgrade glusterfs | Jul 3, 2018 | Apr 18, 2018 |
| Redhat_linux | — | Upgrade glusterfs-server | Apr 19, 2018 | Apr 18, 2018 |
| Suse | — | Upgrade python-glusterUpgrade libgfdb0Upgrade libgfrpc0Upgrade glusterfsUpgrade libgfapi0Upgrade glusterfs-develUpgrade libglusterfs0Upgrade libgfxdr0Upgrade libgfchangelog0 | Jan 21, 2020 | Apr 18, 2018 |
| Ubuntu | — | Upgrade glusterfs-server (Ubuntu Pro)Upgrade glusterfs-client (Ubuntu Pro)Upgrade glusterfs-common (Ubuntu Pro) | Mar 22, 2023 | Apr 18, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub