Published: 20/06/2018 Updated: 12/02/2023

CVSS v2 Base Score: 6.5 | Impact Score: 6.4 | Exploitability Score: 8

CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8

VMScore: 578

Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P

glusterfs is vulnerable to privilege escalation on gluster server nodes. An authenticated gluster client via TLS could use gluster cli with --remote-host command to add it self to trusted storage pool and perform privileged gluster operations like adding other machines to trusted storage pool, start, stop, and delete volumes.

Vulnerable Product	Search on Vulmon	Subscribe to Product
gluster glusterfs
debian debian linux 9.0

Debian Bug report logs - #901968 glusterfs: CVE-2018-10841: access trusted peer group via remote-host command Package: src:glusterfs; Maintainer for src:glusterfs is Patrick Matthäi <pmatthaei@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Wed, 20 Jun 2018 20:00:02 UTC Severity: grave Tags: ...

Synopsis Important: glusterfs security update Type/Severity Security Advisory: Important Topic An update for glusterfs is now available for Native Client for Red Hat Enterprise Linux 6 for Red Hat Storage and Red Hat Gluster Storage 33 for Red Hat Enterprise Linux 6Red Hat Product Security has rated this ...

Synopsis Important: glusterfs security update Type/Severity Security Advisory: Important Topic An update for glusterfs is now available for Native Client for Red Hat Enterprise Linux 7 for Red Hat Storage and Red Hat Gluster Storage 33 for Red Hat Enterprise Linux 7Red Hat Product Security has rated this ...

A flaw was found in glusterfs which can lead to privilege escalation on gluster server nodes An authenticated gluster client via TLS could use gluster cli with --remote-host command to add it self to trusted storage pool and perform privileged gluster operations like adding other machines to trusted storage pool, start, stop, and delete volumes ...

CWE-288 https://review.gluster.org/#/c/20328/https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10841 https://access.redhat.com/errata/RHSA-2018:1955 https://access.redhat.com/errata/RHSA-2018:1954 https://security.gentoo.org/glsa/201904-06 https://lists.debian.org/debian-lts-announce/2021/11/msg00000.html https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=901968 https://nvd.nist.gov https://access.redhat.com/errata/RHSA-2018:1955 https://access.redhat.com/security/cve/cve-2018-10841

CVE-2018-10841

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect