glusterfs server before versions 3.10.12, 4.0.2 is vulnerable when using 'auth.allow' option which allows any unauthenticated gluster client to connect from any network to mount gluster storage volumes. NOTE: this vulnerability exists because of a CVE-2018-1088 regression.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade glusterfs-server | Aug 28, 2019 | Apr 25, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade glusterfs-client-xlatorsUpgrade glusterfs-apiUpgrade glusterfsUpgrade glusterfs-fuseUpgrade glusterfs-rdmaUpgrade glusterfs-libs | Jul 3, 2018 | Apr 25, 2018 |
| Redhat_linux | — | Upgrade glusterfs-server | May 1, 2018 | Apr 25, 2018 |
| Suse | — | Upgrade libgfapi0Upgrade libglusterfs0Upgrade python-glusterUpgrade libgfrpc0Upgrade glusterfs-develUpgrade glusterfsUpgrade libgfxdr0Upgrade libgfchangelog0Upgrade libgfdb0 | Jan 20, 2020 | Apr 25, 2018 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub