Published: 31/10/2018 Updated: 12/02/2023

CVSS v2 Base Score: 6.5 | Impact Score: 6.4 | Exploitability Score: 8

CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8

VMScore: 578

Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P

The Gluster file system through versions 4.1.4 and 3.12 is vulnerable to a heap-based buffer overflow in the '__server_getspec' function via the 'gf_getspec_req' RPC message. A remote authenticated attacker could exploit this to cause a denial of service or other potential unspecified impact.

Vulnerable Product	Search on Vulmon	Subscribe to Product
redhat gluster storage
debian debian linux 8.0
debian debian linux 9.0
redhat enterprise linux server 7.0
redhat enterprise linux server 6.0
redhat enterprise linux virtualization 4.0

Debian Bug report logs - #912997 glusterfs: Several security vulnerabilities Package: glusterfs; Maintainer for glusterfs is Patrick Matthäi <pmatthaei@debianorg>; Reported by: Markus Koschany <apo@debianorg> Date: Mon, 5 Nov 2018 18:12:01 UTC Severity: grave Tags: security Found in version 414-1 Fixed in vers ...

Synopsis Important: glusterfs security and bug fix update Type/Severity Security Advisory: Important Topic Updated glusterfs packages that fix multiple security issues and bugs are now available for Red Hat Gluster Storage 34 on Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as h ...

Synopsis Important: glusterfs security and bug fix update Type/Severity Security Advisory: Important Topic Updated glusterfs packages that fix multiple security issues and bugs are now available for Red Hat Gluster Storage 34 on Red Hat Enterprise Linux 6Red Hat Product Security has rated this update as ...

Synopsis Moderate: Red Hat Virtualization security and bug fix update Type/Severity Security Advisory: Moderate Topic An update for imgbased, redhat-release-virtualization-host, and redhat-virtualization-host is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 7Red Hat Product Securi ...

A buffer overflow on the heap was found in gf_getspec_req RPC request A remote, authenticated attacker could use this flaw to cause denial of service and read arbitrary files on glusterfs server node ...

CWE-122 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14653 https://access.redhat.com/errata/RHSA-2018:3432 https://access.redhat.com/errata/RHSA-2018:3431 https://lists.debian.org/debian-lts-announce/2018/11/msg00003.html https://access.redhat.com/errata/RHSA-2018:3470 https://security.gentoo.org/glsa/201904-06 https://lists.debian.org/debian-lts-announce/2021/11/msg00000.html https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=912997 https://nvd.nist.gov https://access.redhat.com/errata/RHSA-2018:3432 https://access.redhat.com/security/cve/cve-2018-14653

CVE-2018-14653

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect