Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
amazonAmazonALAS2-2018-1128
HistoryDec 13, 2018 - 8:16 p.m.

Medium: glusterfs

2018-12-1320:16:00
alas.aws.amazon.com
12

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

8 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

74.5%

JSON

Issue Overview:

A flaw was found in dict.c:dict_unserialize function of glusterfs, dic_unserialize function does not handle negative key length values. An attacker could use this flaw to read memory from other locations into the stored dict value.(CVE-2018-10911)

Affected Packages:

glusterfs

Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.

Issue Correction:
Run yum update glusterfs to update your system.

New Packages:

aarch64:  
    glusterfs-3.12.2-18.amzn2.aarch64  
    glusterfs-api-3.12.2-18.amzn2.aarch64  
    glusterfs-api-devel-3.12.2-18.amzn2.aarch64  
    glusterfs-cli-3.12.2-18.amzn2.aarch64  
    glusterfs-devel-3.12.2-18.amzn2.aarch64  
    glusterfs-fuse-3.12.2-18.amzn2.aarch64  
    glusterfs-libs-3.12.2-18.amzn2.aarch64  
    python2-gluster-3.12.2-18.amzn2.aarch64  
    glusterfs-rdma-3.12.2-18.amzn2.aarch64  
    glusterfs-client-xlators-3.12.2-18.amzn2.aarch64  
    glusterfs-debuginfo-3.12.2-18.amzn2.aarch64  
  
i686:  
    glusterfs-3.12.2-18.amzn2.i686  
    glusterfs-api-3.12.2-18.amzn2.i686  
    glusterfs-api-devel-3.12.2-18.amzn2.i686  
    glusterfs-cli-3.12.2-18.amzn2.i686  
    glusterfs-devel-3.12.2-18.amzn2.i686  
    glusterfs-fuse-3.12.2-18.amzn2.i686  
    glusterfs-libs-3.12.2-18.amzn2.i686  
    python2-gluster-3.12.2-18.amzn2.i686  
    glusterfs-rdma-3.12.2-18.amzn2.i686  
    glusterfs-client-xlators-3.12.2-18.amzn2.i686  
    glusterfs-debuginfo-3.12.2-18.amzn2.i686  
  
src:  
    glusterfs-3.12.2-18.amzn2.src  
  
x86_64:  
    glusterfs-3.12.2-18.amzn2.x86_64  
    glusterfs-api-3.12.2-18.amzn2.x86_64  
    glusterfs-api-devel-3.12.2-18.amzn2.x86_64  
    glusterfs-cli-3.12.2-18.amzn2.x86_64  
    glusterfs-devel-3.12.2-18.amzn2.x86_64  
    glusterfs-fuse-3.12.2-18.amzn2.x86_64  
    glusterfs-libs-3.12.2-18.amzn2.x86_64  
    python2-gluster-3.12.2-18.amzn2.x86_64  
    glusterfs-rdma-3.12.2-18.amzn2.x86_64  
    glusterfs-client-xlators-3.12.2-18.amzn2.x86_64  
    glusterfs-debuginfo-3.12.2-18.amzn2.x86_64

Additional References

Red Hat: CVE-2018-10911

Mitre: CVE-2018-10911

OSVersionArchitecturePackageVersionFilename
Amazon Linux2aarch64glusterfs< 3.12.2-18.amzn2glusterfs-3.12.2-18.amzn2.aarch64.rpm
Amazon Linux2aarch64glusterfs-api< 3.12.2-18.amzn2glusterfs-api-3.12.2-18.amzn2.aarch64.rpm
Amazon Linux2aarch64glusterfs-api-devel< 3.12.2-18.amzn2glusterfs-api-devel-3.12.2-18.amzn2.aarch64.rpm
Amazon Linux2aarch64glusterfs-cli< 3.12.2-18.amzn2glusterfs-cli-3.12.2-18.amzn2.aarch64.rpm
Amazon Linux2aarch64glusterfs-devel< 3.12.2-18.amzn2glusterfs-devel-3.12.2-18.amzn2.aarch64.rpm
Amazon Linux2aarch64glusterfs-fuse< 3.12.2-18.amzn2glusterfs-fuse-3.12.2-18.amzn2.aarch64.rpm
Amazon Linux2aarch64glusterfs-libs< 3.12.2-18.amzn2glusterfs-libs-3.12.2-18.amzn2.aarch64.rpm
Amazon Linux2aarch64python2-gluster< 3.12.2-18.amzn2python2-gluster-3.12.2-18.amzn2.aarch64.rpm
Amazon Linux2aarch64glusterfs-rdma< 3.12.2-18.amzn2glusterfs-rdma-3.12.2-18.amzn2.aarch64.rpm
Amazon Linux2aarch64glusterfs-client-xlators< 3.12.2-18.amzn2glusterfs-client-xlators-3.12.2-18.amzn2.aarch64.rpm
Rows per page:
1-10 of 331

Related

osv 4
centos 2
nessus 28
nvd 1
openvas 11
redhatcve 1
prion 1
ubuntucve 1
veracode 2
oraclelinux 2
redhat 5
cve 1
debiancve 1
cvelist 1
debian 2
ibm 1
fedora 3
suse 1
gentoo 1
ubuntu 1
osv
osv
CVE-2018-10911
2018-09-04 14:29:00
glusterfs - security update
2018-09-20 00:00:00
glusterfs - security update
2021-11-01 00:00:00
centos
centos
glusterfs, python2 security update
2018-10-09 20:21:55
glusterfs, python2 security update
2018-11-15 18:45:47
nessus
nessus
CentOS 6 : glusterfs (CESA-2018:2892)
2018-10-10 00:00:00
EulerOS Virtualization 2.5.4 : glusterfs (EulerOS-SA-2019-1192)
2019-04-09 00:00:00
Amazon Linux 2 : glusterfs (ALAS-2018-1128)
2018-12-20 00:00:00
nvd
nvd
CVE-2018-10911
2018-09-04 14:29:00
openvas
openvas
Huawei EulerOS: Security Advisory for glusterfs (EulerOS-SA-2019-1192)
2020-01-23 00:00:00
CentOS Update for glusterfs CESA-2018:2892 centos6
2018-10-10 00:00:00
Huawei EulerOS: Security Advisory for glusterfs (EulerOS-SA-2018-1442)
2020-01-23 00:00:00
redhatcve
redhatcve
CVE-2018-10911
2018-09-04 05:51:49
prion
prion
Design/Logic Flaw
2018-09-04 14:29:00
ubuntucve
ubuntucve
CVE-2018-10911
2018-09-04 00:00:00
veracode
veracode
Information Disclosure
2018-09-12 07:59:10
Information Disclosure
2019-01-15 09:25:12
oraclelinux
oraclelinux
glusterfs security, bug fix, and enhancement update
2018-11-05 00:00:00
glusterfs security, bug fix, and enhancement update
2018-10-09 00:00:00
redhat
redhat
(RHSA-2018:3242) Moderate: glusterfs security, bug fix, and enhancement update
2018-10-30 04:33:39
(RHSA-2018:2892) Moderate: glusterfs security, bug fix, and enhancement update
2018-10-09 14:48:14
(RHSA-2018:2608) Important: Red Hat Gluster Storage security, bug fix, and enhancement update
2018-09-04 06:13:58
cve
cve
CVE-2018-10911
2018-09-04 14:29:00
debiancve
debiancve
CVE-2018-10911
2018-09-04 14:29:00
cvelist
cvelist
CVE-2018-10911
2018-09-04 14:00:00
debian
debian
[SECURITY] [DLA 1510-1] glusterfs security update
2018-09-20 10:16:27
[SECURITY] [DLA 2806-1] glusterfs security update
2021-11-01 23:25:14
ibm
ibm
Security Bulletin: Vulnerabilities in glusterfs affect PowerKVM
2018-12-17 14:30:02
fedora
fedora
[SECURITY] Fedora 29 Update: glusterfs-4.1.5-1.fc29
2018-10-02 19:35:20
[SECURITY] Fedora 28 Update: glusterfs-4.1.4-1.fc28
2018-09-11 17:04:27
[SECURITY] Fedora 27 Update: glusterfs-3.12.14-1.fc27
2018-09-28 17:14:10
suse
suse
Security update for glusterfs (moderate)
2020-01-20 00:00:00
gentoo
gentoo
GlusterFS: Multiple Vulnerabilities
2019-04-02 00:00:00
ubuntu
ubuntu
GlusterFS vulnerabilities
2021-03-15 00:00:00

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

8 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

74.5%

JSON
Related for ALAS2-2018-1128
osv4centos2nessus28nvd1openvas11redhatcve1prion1ubuntucve1veracode2oraclelinux2redhat5cve1debiancve1cvelist1debian2ibm1fedora3suse1gentoo1ubuntu1