Vulnerability Details : CVE-2018-10927
A flaw was found in RPC request using gfs3_lookup_req in glusterfs server. An authenticated attacker could use this flaw to leak information and execute remote denial of service by crashing gluster brick process.
Vulnerability category: Input validationDenial of serviceInformation leak
Products affected by CVE-2018-10927
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
- cpe:2.3:a:gluster:glusterfs:*:*:*:*:*:*:*:*
- cpe:2.3:a:gluster:glusterfs:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2018-10927
0.78%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 81 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2018-10927
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.5
|
MEDIUM | AV:N/AC:L/Au:S/C:P/I:N/A:P |
8.0
|
4.9
|
NIST | |
|
7.1
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H |
2.8
|
4.2
|
Red Hat, Inc. | |
|
8.1
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |
2.8
|
5.2
|
NIST |
CWE ids for CVE-2018-10927
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: secalert@redhat.com (Primary)
-
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Assigned by: nvd@nist.gov (Secondary)
References for CVE-2018-10927
-
https://security.gentoo.org/glsa/201904-06
GlusterFS: Multiple Vulnerabilities (GLSA 201904-06) — Gentoo securityThird Party Advisory
-
https://access.redhat.com/errata/RHSA-2018:3470
RHSA-2018:3470 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
https://lists.debian.org/debian-lts-announce/2021/11/msg00000.html
[SECURITY] [DLA 2806-1] glusterfs security updateMailing List;Third Party Advisory
-
https://access.redhat.com/errata/RHSA-2018:2607
RHSA-2018:2607 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
https://access.redhat.com/errata/RHSA-2018:2608
RHSA-2018:2608 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
https://lists.debian.org/debian-lts-announce/2018/09/msg00021.html
[SECURITY] [DLA 1510-1] glusterfs security updateMailing List;Third Party Advisory
-
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10927
1612658 – (CVE-2018-10927) CVE-2018-10927 glusterfs: File status information leak and denial of serviceIssue Tracking;Patch;Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00035.html
[security-announce] openSUSE-SU-2020:0079-1: moderate: Security update fMailing List;Third Party Advisory
Jump to