Upstream information
Description
A privilege escalation flaw was found in gluster 3.x snapshot scheduler. Any gluster client allowed to mount gluster volumes could also mount shared gluster storage volume and escalate privileges by scheduling malicious cronjob via symlink.SUSE information
Overall state of this security issue: Does not affect SUSE products
This issue is currently rated as having important severity.
National Vulnerability Database | |
---|---|
Base Score | 6.8 |
Vector | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Access Vector | Network |
Access Complexity | Medium |
Authentication | None |
Confidentiality Impact | Partial |
Integrity Impact | Partial |
Availability Impact | Partial |
National Vulnerability Database | |
---|---|
Base Score | 8.1 |
Vector | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Access Vector | Network |
Access Complexity | High |
Privileges Required | None |
User Interaction | None |
Scope | Unchanged |
Confidentiality Impact | High |
Integrity Impact | High |
Availability Impact | High |
CVSSv3 Version | 3 |
- openSUSE-SU-2020:0079-1, published Mon, 20 Jan 2020 06:11:03 +0100 (CET)
List of released packages
Product(s) | Fixed package version(s) | References |
---|---|---|
openSUSE Leap 15.1 |
| Patchnames: openSUSE-2020-79 |
openSUSE Tumbleweed |
| Patchnames: openSUSE Tumbleweed GA glusterfs-9.1-1.3 |