CVE-2018-10841
Last modified
CVE-2018-10841 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. glusterfs is vulnerable to privilege escalation on gluster server nodes. An authenticated gluster client via TLS could use gluster cli with --remote-host command to add it self to trusted storage pool and perform privileged gluster operations like adding other machines to trusted storage pool, start, stop, and delete volumes.. EPSS estimates a 1.28% chance of exploitation in the next 30 days.
Description
glusterfs is vulnerable to privilege escalation on gluster server nodes. An authenticated gluster client via TLS could use gluster cli with --remote-host command to add it self to trusted storage pool and perform privileged gluster operations like adding other machines to trusted storage pool, start, stop, and delete volumes.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Gluster | Glusterfs | < 4.1.8 |
| Debian | Debian Linux | 9.0 |
References
- https://access.redhat.com/errata/RHSA-2018:1954Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1955Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10841Issue Tracking, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/11/msg00000.htmlMailing List, Third Party Advisory
- https://review.gluster.org/#/c/20328/Patch, Third Party Advisory
- https://security.gentoo.org/glsa/201904-06Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1954Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1955Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10841Issue Tracking, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/11/msg00000.htmlMailing List, Third Party Advisory
- https://review.gluster.org/#/c/20328/Patch, Third Party Advisory
- https://security.gentoo.org/glsa/201904-06Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-10841?
How severe is CVE-2018-10841?
How do I fix CVE-2018-10841?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-10830In 2345 Security Guard 3.7, the driver file (2345BdPcSafe.sy…
- CVE-2018-10831Z-NOMP before 2018-04-05 has an incorrect Equihash solution …
- CVE-2018-10832ModbusPal 1.6b is vulnerable to an XML External Entity (XXE)…
- CVE-2018-10839Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation s…6.5
- CVE-2018-1084corosync before version 2.4.4 is vulnerable to an integer ov…7.5
- CVE-2018-10840Linux kernel is vulnerable to a heap-based buffer overflow i…6.6
- CVE-2018-10842Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2018-10843source-to-image component of Openshift Container Platform be…8.5
- CVE-2018-10844It was found that the GnuTLS implementation of HMAC-SHA-256 …5.9
- CVE-2018-10845It was found that the GnuTLS implementation of HMAC-SHA-384 …5.9
- CVE-2018-10846A cache-based side channel in GnuTLS implementation that lea…5.6
- CVE-2018-10847prosody before versions 0.10.2, 0.9.14 is vulnerable to an A…4.2
Are you affected by CVE-2018-10841?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST