CVE-2018-10841: High severity centos glusterfs vulnerability
A flaw was found in glusterfs which can lead to privilege escalation on gluster server nodes.
It was found that any gluster client authenticated via TLS could use gluster cli with --remote-host command to add itself to gluster trusted pool and perform all gluster operations like peer probe itself or other machines, start, stop, delete volumes etc.
Other sources
glusterfs is vulnerable to privilege escalation on gluster server nodes. An authenticated gluster client via TLS could use gluster cli with --remote-host command to add it self to trusted storage pool and perform privileged gluster operations like adding other machines to trusted storage pool, start, stop, and delete volumes.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2018-10841.
What is the severity of CVE-2018-10841?
The severity of CVE-2018-10841 is high with a CVSS score of 8.8.
What software is affected by CVE-2018-10841?
Gluster GlusterFS versions up to 4.1.8 and Debian Linux version 9.0 are affected by CVE-2018-10841.
How can an attacker exploit CVE-2018-10841?
An authenticated gluster client could use the gluster cli with the --remote-host command to add itself to the trusted storage pool and perform privileged operations on the gluster server nodes.
Are there any references for CVE-2018-10841?
Yes, you can find more information about CVE-2018-10841 at the following references: [Reference 1](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1593230), [Reference 2](https://access.redhat.com/errata/RHSA-2018:1955), [Reference 3](https://access.redhat.com/errata/RHSA-2018:1954).