ByteOS Network

NVD Vulnerability Details :

CVE-2018-1112

Modified

Source-secalert@redhat.com

Published At-25 Apr, 2018 | 12:29

Updated At-09 Oct, 2019 | 23:38

glusterfs server before versions 3.10.12, 4.0.2 is vulnerable when using 'auth.allow' option which allows any unauthenticated gluster client to connect from any network to mount gluster storage volumes. NOTE: this vulnerability exists because of a CVE-2018-1088 regression.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	8.8	HIGH	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Secondary	3.0	8.0	HIGH	CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary	2.0	7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P

CPE Matches

gluster>>glusterfs>>Versions before 3.10.12(exclusive)

cpe:2.3:a:gluster:glusterfs:*:*:*:*:*:*:*:*

gluster>>glusterfs>>4.0.2

cpe:2.3:a:gluster:glusterfs:4.0.2:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
NVD-CWE-noinfo	Primary	nvd@nist.gov
CWE-287	Secondary	secalert@redhat.com

References

Hyperlink	Source	Resource
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00035.html	secalert@redhat.com	N/A
https://access.redhat.com/articles/3422521	secalert@redhat.com	Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1268	secalert@redhat.com	Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1269	secalert@redhat.com	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1112	secalert@redhat.com	Issue Tracking Third Party Advisory
https://review.gluster.org/#/c/19899/1..2	secalert@redhat.com	Vendor Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History