CVEvulnerability
CVE-2018-1112
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2018-04-25
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 8.0 HIGH — CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS 3.0 ([email protected])
- 8.8 HIGH — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-287
Description
glusterfs server before versions 3.10.12, 4.0.2 is vulnerable when using 'auth.allow' option which allows any unauthenticated gluster client to connect from any network to mount gluster storage volumes. NOTE: this vulnerability exists because of a CVE-2018-1088 regression.
Affected configurations
• gluster glusterfs (< 3.10.12)
• gluster glusterfs 4.0.2
Related
Weakness · CWE (1)
- CWE-287 Improper Authentication weakness
References
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00035.html lists.opensuse.org
- https://access.redhat.com/articles/3422521 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1268 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1269 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1112 Issue Tracking, Third Party Advisory
- https://review.gluster.org/#/c/19899/1..2 Vendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00035.html lists.opensuse.org
- https://access.redhat.com/articles/3422521 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1268 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1269 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1112 Issue Tracking, Third Party Advisory
- https://review.gluster.org/#/c/19899/1..2 Vendor Advisory