Published: 31/10/2018 Updated: 13/02/2023

CVSS v2 Base Score: 8.5 | Impact Score: 9.2 | Exploitability Score: 8

CVSS v3 Base Score: 6.5 | Impact Score: 3.6 | Exploitability Score: 2.8

VMScore: 756

Vector: AV:N/AC:L/Au:S/C:N/I:C/A:C

The Gluster file system through version 4.1.4 is vulnerable to abuse of the 'features/index' translator. A remote attacker with access to mount volumes could exploit this via the 'GF_XATTROP_ENTRY_IN_KEY' xattrop to create arbitrary, empty files on the target server.

Vulnerable Product	Search on Vulmon	Subscribe to Product
redhat gluster storage
redhat enterprise linux server 7.0
redhat enterprise linux server 6.0
redhat enterprise linux virtualization 4.0
redhat virtualization 4.0
redhat virtualization_host 4.0
debian debian linux 9.0

Debian Bug report logs - #912997 glusterfs: Several security vulnerabilities Package: glusterfs; Maintainer for glusterfs is Patrick Matthäi <pmatthaei@debianorg>; Reported by: Markus Koschany <apo@debianorg> Date: Mon, 5 Nov 2018 18:12:01 UTC Severity: grave Tags: security Found in version 414-1 Fixed in vers ...

Synopsis Important: glusterfs security and bug fix update Type/Severity Security Advisory: Important Topic Updated glusterfs packages that fix multiple security issues and bugs are now available for Red Hat Gluster Storage 34 on Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as h ...

Synopsis Important: glusterfs security and bug fix update Type/Severity Security Advisory: Important Topic Updated glusterfs packages that fix multiple security issues and bugs are now available for Red Hat Gluster Storage 34 on Red Hat Enterprise Linux 6Red Hat Product Security has rated this update as ...

Synopsis Moderate: Red Hat Virtualization security and bug fix update Type/Severity Security Advisory: Moderate Topic An update for imgbased, redhat-release-virtualization-host, and redhat-virtualization-host is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 7Red Hat Product Securi ...

A flaw was found in the way glusterfs server handles client requests A remote, authenticated attacker could set arbitrary values for the GF_XATTROP_ENTRY_IN_KEY and GF_XATTROP_ENTRY_OUT_KEY during xattrop file operation resulting in creation and deletion of arbitrary files on glusterfs server node ...

CWE-22 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14654 https://access.redhat.com/errata/RHSA-2018:3432 https://access.redhat.com/errata/RHSA-2018:3431 https://access.redhat.com/errata/RHSA-2018:3470 https://security.gentoo.org/glsa/201904-06 https://lists.debian.org/debian-lts-announce/2021/11/msg00000.html https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=912997 https://nvd.nist.gov https://access.redhat.com/errata/RHSA-2018:3432 https://access.redhat.com/security/cve/cve-2018-14654

CVE-2018-14654

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect