glusterfs server before versions 3.10.12, 4.0.2 is vulnerable when using 'auth.allow' option which allows any unauthenticated gluster client to connect from any network to mount gluster storage volumes. NOTE: this vulnerability exists because of a CVE-2018-1088 regression.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.0 Base Score: 8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade glusterfs-server | Aug 28, 2019 | Apr 25, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade glusterfs-client-xlatorsUpgrade glusterfs-apiUpgrade glusterfsUpgrade glusterfs-libsUpgrade glusterfs-rdmaUpgrade glusterfs-fuse | Jul 3, 2018 | Apr 25, 2018 |
| Redhat_linux | — | Upgrade glusterfs-server | May 1, 2018 | Apr 25, 2018 |
| Suse | — | Upgrade glusterfs-develUpgrade libgfxdr0Upgrade libgfdb0Upgrade libgfrpc0Upgrade libgfchangelog0Upgrade glusterfsUpgrade python-glusterUpgrade libgfapi0Upgrade libglusterfs0 | Jan 20, 2020 | Apr 25, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub