CVE-2018-1088

Upstream information

CVE-2018-1088 at MITRE

Description

A privilege escalation flaw was found in gluster 3.x snapshot scheduler. Any gluster client allowed to mount gluster volumes could also mount shared gluster storage volume and escalate privileges by scheduling malicious cronjob via symlink.

---

SUSE information

Overall state of this security issue: Does not affect SUSE products

This issue is currently rated as having important severity.

CVSS v2 Scores

	National Vulnerability Database
Base Score	6.8
Vector	AV:N/AC:M/Au:N/C:P/I:P/A:P
Access Vector	Network
Access Complexity	Medium
Authentication	None
Confidentiality Impact	Partial
Integrity Impact	Partial
Availability Impact	Partial

CVSS v3 Scores

	National Vulnerability Database
Base Score	8.1
Vector	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Access Vector	Network
Access Complexity	High
Privileges Required	None
User Interaction	None
Scope	Unchanged
Confidentiality Impact	High
Integrity Impact	High
Availability Impact	High
CVSSv3 Version	3

SUSE Bugzilla entry: 1090084 [RESOLVED / FIXED]

SUSE Security Advisories:

• openSUSE-SU-2020:0079-1, published Mon, 20 Jan 2020 06:11:03 +0100 (CET)

List of released packages

Product(s)	Fixed package version(s)	References
openSUSE Leap 15.1	glusterfs >= 3.12.15-lp151.3.3.1 glusterfs-debuginfo >= 3.12.15-lp151.3.3.1 glusterfs-debugsource >= 3.12.15-lp151.3.3.1 glusterfs-devel >= 3.12.15-lp151.3.3.1 libgfapi0 >= 3.12.15-lp151.3.3.1 libgfapi0-debuginfo >= 3.12.15-lp151.3.3.1 libgfchangelog0 >= 3.12.15-lp151.3.3.1 libgfchangelog0-debuginfo >= 3.12.15-lp151.3.3.1 libgfdb0 >= 3.12.15-lp151.3.3.1 libgfdb0-debuginfo >= 3.12.15-lp151.3.3.1 libgfrpc0 >= 3.12.15-lp151.3.3.1 libgfrpc0-debuginfo >= 3.12.15-lp151.3.3.1 libgfxdr0 >= 3.12.15-lp151.3.3.1 libgfxdr0-debuginfo >= 3.12.15-lp151.3.3.1 libglusterfs0 >= 3.12.15-lp151.3.3.1 libglusterfs0-debuginfo >= 3.12.15-lp151.3.3.1 python-gluster >= 3.12.15-lp151.3.3.1	Patchnames: openSUSE-2020-79