High severity · published Apr 25, 2018
CVE-2018-1112
glusterfs server before versions 3.10.12, 4.0.2 is vulnerable when using 'auth.allow' option which allows any unauthenticated gluster client to connect from any network to mount…
8.8
CVSS
2.3%
EPSS
No
On KEV
Description
glusterfs server before versions 3.10.12, 4.0.2 is vulnerable when using 'auth.allow' option which allows any unauthenticated gluster client to connect from any network to mount gluster storage volumes. NOTE: this vulnerability exists because of a CVE-2018-1088 regression.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GL
Glusterfs · Gluster
before 3.10.12; 4.0.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-1112
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-1112
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00035.html
Third Party Advisory
https://access.redhat.com/articles/3422521
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1268
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1269
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1112
Vendor Advisory
https://review.gluster.org/#/c/19899/1..2
More from Glusterfs
8.8
CVE-2018-14651
It was found that the fix for CVE-2018-10927, CVE-2018-10928, CVE-2018-10929, CVE-2018-10930, and CVE-2018-10926 was incomplete
8.8
CVE-2018-10929
A flaw was found in RPC request using gfs2_create_req in glusterfs server
8.8
CVE-2018-10928
A flaw was found in RPC request using gfs3_symlink_req in glusterfs server which allows symlink destinations to point to file paths outside of the gluster volume
8.8
CVE-2018-10926
A flaw was found in RPC request using gfs3_mknod_req supported by glusterfs server
8.8
CVE-2018-10907
It was found that glusterfs server is vulnerable to multiple stack based buffer overflows due to functions in server-rpc-fopc.c allocating fixed size buffers using 'alloca(3)'