Vulnerability Details : CVE-2018-10930
A flaw was found in RPC request using gfs3_rename_req in glusterfs server. An authenticated attacker could use this flaw to write to a destination outside the gluster volume.
Vulnerability category: Input validation
Products affected by CVE-2018-10930
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
- cpe:2.3:a:gluster:glusterfs:*:*:*:*:*:*:*:*
- cpe:2.3:a:gluster:glusterfs:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2018-10930
0.09%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 39 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2018-10930
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.0
|
MEDIUM | AV:N/AC:L/Au:S/C:N/I:P/A:N |
8.0
|
2.9
|
NIST | |
|
6.5
|
MEDIUM | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
2.8
|
3.6
|
Red Hat, Inc. | |
|
6.5
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
2.8
|
3.6
|
NIST |
CWE ids for CVE-2018-10930
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: secalert@redhat.com (Primary)
References for CVE-2018-10930
-
https://security.gentoo.org/glsa/201904-06
GlusterFS: Multiple Vulnerabilities (GLSA 201904-06) — Gentoo securityThird Party Advisory
-
https://access.redhat.com/errata/RHSA-2018:3470
RHSA-2018:3470 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
https://lists.debian.org/debian-lts-announce/2021/11/msg00000.html
[SECURITY] [DLA 2806-1] glusterfs security updateMailing List;Third Party Advisory
-
https://access.redhat.com/errata/RHSA-2018:2607
RHSA-2018:2607 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
https://access.redhat.com/errata/RHSA-2018:2608
RHSA-2018:2608 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10930
1612664 – (CVE-2018-10930) CVE-2018-10930 glusterfs: Files can be renamed outside volumeIssue Tracking;Patch;Third Party Advisory
-
https://lists.debian.org/debian-lts-announce/2018/09/msg00021.html
[SECURITY] [DLA 1510-1] glusterfs security updateMailing List;Third Party Advisory
-
https://review.gluster.org/#/c/glusterfs/+/21068/
Change Id9fe0ef6: server-protocol: don't allow '../' path in 'name' | review.gluster Code ReviewPatch;Vendor Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00035.html
[security-announce] openSUSE-SU-2020:0079-1: moderate: Security update fMailing List;Third Party Advisory
Jump to