CVE-2018-14654: Path Traversal
The Gluster file system through version 4.1.4 is vulnerable to abuse of the 'features/index' translator. A remote attacker with access to mount volumes could exploit this via the 'GFXATTROPENTRYINKEY' xattrop to create arbitrary, empty files on the target server.
Other sources
The Gluster file system through version 4.1.4 is vulnerable to abuse of the "features/index" translator. A remote attacker with access to mount volumes could exploit this via the "GFXATTROPENTRYINKEY" xattrop to create arbitrary, empty files on the target server.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-14654?
CVE-2018-14654 is a vulnerability in the Gluster file system through version 4.1.4 that allows a remote attacker to create arbitrary, empty files on the target server.
How can an attacker exploit CVE-2018-14654?
An attacker with access to mount volumes can exploit CVE-2018-14654 by using the 'GF_XATTROP_ENTRY_IN_KEY' xattrop to create arbitrary, empty files on the target server.
Which software versions are affected by CVE-2018-14654?
The affected software versions include Redhat Gluster Storage up to and including version 4.1.4, Redhat Enterprise Linux Server 6.0 and 7.0, Redhat Enterprise Linux Virtualization 4.0, Redhat Virtualization 4.0, Redhat Virtualization Host 4.0, and Debian Debian Linux 9.0.
What is the severity of CVE-2018-14654?
CVE-2018-14654 has a severity value of 6.5, which is considered high.
How do I fix CVE-2018-14654?
To fix CVE-2018-14654, ensure you have updated to a patched version of the Gluster file system. Refer to the provided references for more information.