A privilege escalation flaw was found in gluster 3.x snapshot scheduler. Any gluster client allowed to mount gluster volumes could also mount shared gluster storage volume and escalate privileges by scheduling malicious cronjob via symlink.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade glusterfs-server | Aug 28, 2019 | Apr 18, 2018 |
| Debian | — | Upgrade glusterfs | Feb 19, 2019 | Apr 18, 2018 |
| Gentoo Linux | — | Upgrade sys-cluster/glusterfs. | Apr 3, 2019 | Apr 18, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade glusterfs-libsUpgrade glusterfs-rdmaUpgrade glusterfs-fuseUpgrade glusterfs-client-xlatorsUpgrade glusterfs-apiUpgrade glusterfs | Jul 3, 2018 | Apr 18, 2018 |
| Redhat_linux | — | Upgrade glusterfs-server | Apr 19, 2018 | Apr 18, 2018 |
| Suse | — | Upgrade libgfapi0Upgrade libgfchangelog0Upgrade libgfxdr0Upgrade libglusterfs0Upgrade glusterfs-develUpgrade libgfrpc0Upgrade python-glusterUpgrade libgfdb0Upgrade glusterfs | Jan 21, 2020 | Apr 18, 2018 |
| Ubuntu | — | Upgrade glusterfs-client (Ubuntu Pro)Upgrade glusterfs-common (Ubuntu Pro)Upgrade glusterfs-server (Ubuntu Pro) | Mar 22, 2023 | Apr 18, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub