First published: Wed Sep 26 2018(Updated: )
The Gluster file system through versions 3.12 and 4.1.4 is vulnerable to a buffer overflow in the 'features/index' translator via the code handling the 'GF_XATTR_CLRLK_CMD' xattr in the 'pl_getxattr' function. A remote authenticated attacker could exploit this on a mounted volume to cause a denial of service.
Credit: secalert@redhat.com
Affected Software | Affected Version | How to fix |
---|---|---|
Redhat Gluster Storage | >=3.0.0<=3.1.2 | |
Redhat Gluster Storage | >=4.1.0<=4.1.8 | |
Debian Debian Linux | =8.0 | |
Debian Debian Linux | =9.0 | |
Redhat Enterprise Virtualization Host | =4.0 | |
Redhat Enterprise Linux Server | =6.0 | |
Redhat Enterprise Linux Server | =7.0 | |
Redhat Enterprise Linux Virtualization | =4.0 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2018-14652 is a vulnerability in the Gluster file system that allows a remote authenticated attacker to cause a denial of service via a buffer overflow.
Gluster file system versions 3.0.0 to 3.12 and 4.1.0 to 4.1.4 are affected by CVE-2018-14652.
CVE-2018-14652 has a severity score of 6.5 out of 10, which is considered medium severity.
An attacker with remote authenticated access can exploit CVE-2018-14652 by causing a buffer overflow through the 'features/index' translator in the Gluster file system, leading to a denial of service.
Yes, a fix for CVE-2018-14652 is available. Please refer to the official references for the respective software versions affected.