CVEvulnerability
CVE-2018-1088
8.1 HIGH
Official page ↗
- Status
- Modified
- Published
- 2018-04-18
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.1 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-266
Description
A privilege escalation flaw was found in gluster 3.x snapshot scheduler. Any gluster client allowed to mount gluster volumes could also mount shared gluster storage volume and escalate privileges by scheduling malicious cronjob via symlink.
Affected configurations
• redhat gluster storage (>= 3.0 <= 3.13.2)
• redhat virtualization 4.0
• redhat virtualization host 4.0
• redhat enterprise linux server 6.0
• redhat enterprise linux server 7.0
• opensuse leap 15.1
• debian debian linux 9.0
Related
Weakness · CWE (1)
- CWE-266 Incorrect Privilege Assignment weakness
References
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00035.html Mailing List, Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1136 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2018:1137 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2018:1275 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2018:1524 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1558721 Issue Tracking, Patch, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2021/11/msg00000.html Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/201904-06 Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00035.html Mailing List, Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1136 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2018:1137 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2018:1275 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2018:1524 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1558721 Issue Tracking, Patch, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2021/11/msg00000.html Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/201904-06 Third Party Advisory