Code injection

2018-09-0413:29:00

PRIOn knowledge base

www.prio-n.com

8.7 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

56.7%

JSON

It was found that glusterfs server does not properly sanitize file paths in the “trusted.io-stats-dump” extended attribute which is used by the “debug/io-stats” translator. Attacker can use this flaw to create files and execute arbitrary code. To exploit this attacker would require sufficient access to modify the extended attributes of files on a gluster volume.

CPENameOperatorVersion
debian_linuxeq8.0
debian_linuxeq9.0
glusterfsge3.12.0
glusterfslt3.12.14
glusterfsge4.1.0
glusterfslt4.1.8
leapeq15.1
enterprise_linux_servereq7.0
enterprise_linux_servereq6.0
virtualization_hosteq4.0

Name	Operator	Version
debian_linux	eq	8.0
debian_linux	eq	9.0
glusterfs	ge	3.12.0
glusterfs	lt	3.12.14
glusterfs	ge	4.1.0
glusterfs	lt	4.1.8
leap	eq	15.1
enterprise_linux_server	eq	7.0
enterprise_linux_server	eq	6.0
virtualization_host	eq	4.0