Glusterfs (Gluster) - vulnerabilities (CVEs)

23 CVEs, 0 in the last 30 days, 266 known versions, newest CVE from 2023-02-21. Vendor: Gluster.

CVEs of Glusterfs

CVE-2023-26253 - CVSS 7.5 (high), 2023-02-21: In Gluster GlusterFS 11.0, there is an xlators/mount/fuse/src/fuse-bridge.c notify stack-based buffer over-read.
CVE-2022-48340 - CVSS 7.5 (high), 2023-02-21: In Gluster GlusterFS 11.0, there is an xlators/cluster/dht/src/dht-common.c dht_setxattr_mds_cbk use-after-free.
CVE-2018-14660 - CVSS 6.5 (medium), 2018-11-01: A flaw was found in glusterfs server through versions 4.1.4 and 3.1.2 which allowed repeated usage of GF_META_LOCK_KEY xattr. A remote, authenticated attacker…
CVE-2018-14651 - CVSS 8.8 (high), 2018-10-31: It was found that the fix for CVE-2018-10927, CVE-2018-10928, CVE-2018-10929, CVE-2018-10930, and CVE-2018-10926 was incomplete. A remote, authenticated…
CVE-2018-14661 - CVSS 6.5 (medium), 2018-10-31: It was found that usage of snprintf function in feature/locks translator of glusterfs server 3.8.4, as shipped with Red Hat Gluster Storage, was vulnerable to…
CVE-2018-10930 - CVSS 6.5 (medium), 2018-09-04: A flaw was found in RPC request using gfs3_rename_req in glusterfs server. An authenticated attacker could use this flaw to write to a destination outside the…
CVE-2018-10929 - CVSS 8.8 (high), 2018-09-04: A flaw was found in RPC request using gfs2_create_req in glusterfs server. An authenticated attacker could use this flaw to create arbitrary files and execute…
CVE-2018-10927 - CVSS 8.1 (high), 2018-09-04: A flaw was found in RPC request using gfs3_lookup_req in glusterfs server. An authenticated attacker could use this flaw to leak information and execute…
CVE-2018-10926 - CVSS 8.8 (high), 2018-09-04: A flaw was found in RPC request using gfs3_mknod_req supported by glusterfs server. An authenticated attacker could use this flaw to write files to an…
CVE-2018-10924 - CVSS 6.5 (medium), 2018-09-04: It was discovered that fsync(2) system call in glusterfs client code leaks memory. An authenticated attacker could use this flaw to launch a denial of service…
CVE-2018-10928 - CVSS 8.8 (high), 2018-09-04: A flaw was found in RPC request using gfs3_symlink_req in glusterfs server which allows symlink destinations to point to file paths outside of the gluster…
CVE-2018-10923 - CVSS 8.1 (high), 2018-09-04: It was found that the "mknod" call derived from mknod(2) can create files pointing to devices on a glusterfs server node. An authenticated attacker could use…
CVE-2018-10914 - CVSS 6.5 (medium), 2018-09-04: It was found that an attacker could issue a xattr request via glusterfs FUSE to cause gluster brick process to crash which will result in a remote denial of…
CVE-2018-10913 - CVSS 6.5 (medium), 2018-09-04: An information disclosure vulnerability was discovered in glusterfs server. An attacker could issue a xattr request via glusterfs FUSE to determine the…
CVE-2018-10911 - CVSS 7.5 (high), 2018-09-04: A flaw was found in the way dic_unserialize function of glusterfs does not handle negative key length values. An attacker could use this flaw to read memory…
CVE-2018-10907 - CVSS 8.8 (high), 2018-09-04: It was found that glusterfs server is vulnerable to multiple stack based buffer overflows due to functions in server-rpc-fopc.c allocating fixed size buffers…
CVE-2018-10904 - CVSS 8.8 (high), 2018-09-04: It was found that glusterfs server does not properly sanitize file paths in the "trusted.io-stats-dump" extended attribute which is used by the…
CVE-2018-10841 - CVSS 8.8 (high), 2018-06-20: glusterfs is vulnerable to privilege escalation on gluster server nodes. An authenticated gluster client via TLS could use gluster cli with --remote-host…
CVE-2018-1112 - CVSS 8.8 (high), 2018-04-25: glusterfs server before versions 3.10.12, 4.0.2 is vulnerable when using 'auth.allow' option which allows any unauthenticated gluster client to connect from…
CVE-2017-15096 - CVSS 3.3 (low), 2017-10-26: A flaw was found in GlusterFS in versions prior to 3.10. A null pointer dereference in send_brick_req function in glusterfsd/src/gf_attach.c may be used to…
CVE-2014-3619 - CVSS 5 (medium), 2015-03-27: The __socket_proto_state_machine function in GlusterFS 3.5 allows remote attackers to cause a denial of service (infinite loop) via a "00000000" fragment…
CVE-2012-5635 - CVSS 2.1 (low), 2013-04-09: The GlusterFS functionality in Red Hat Storage Management Console 2.0, Native Client, and Server 2.0 allows local users to overwrite arbitrary files via a…
CVE-2012-4417 - CVSS 3.6 (low), 2012-11-18: GlusterFS 3.3.0, as used in Red Hat Storage server 2.0, allows local users to overwrite arbitrary files via a symlink attack on temporary files with…