VulnerabilityModified
CVE-2018-1112
glusterfs server before versions 3.10.12, 4.0.2 is vulnerable when using 'auth.allow' option which allows any unauthenticated gluster client to connect from any network to mount gluster storage volumes.
HIGH 8.8EPSS 2.39%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.39%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
glusterfs server before versions 3.10.12, 4.0.2 is vulnerable when using 'auth.allow' option which allows any unauthenticated gluster client to connect from any network to mount gluster storage volumes. NOTE: this vulnerability exists because of a CVE-2018-1088 regression.
- CVSS 3.0
- 8.8 HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 2.39% probability · 83th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-287
- Affected
- gluster/glusterfs
- Source
- secalert@redhat.com
References
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00035.html
- https://access.redhat.com/articles/3422521Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1268Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1269Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1112Issue Tracking, Third Party Advisory
- https://review.gluster.org/#/c/19899/1..2Vendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00035.html
- https://access.redhat.com/articles/3422521Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1268Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1269Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1112Issue Tracking, Third Party Advisory
- https://review.gluster.org/#/c/19899/1..2Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.