Bug 655546

Summary:	sys-cluster/glusterfs: CVE-2018-1088
Product:	Gentoo Security	Reporter:	tonemgub
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED DUPLICATE
Severity:	normal
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:
Package list:		Runtime testing required:	---

Description tonemgub 2018-05-12 00:29:21 UTC

http://openwall.com/lists/oss-security/2018/04/18/1

A privilege escalation flaw was found in gluster 3.x snapshot scheduler. Any gluster client allowed to mount gluster volumes could also mount shared gluster storage volume and escalate privileges by scheduling malicious cronjob via symlink. 

Patch Ref: https://review.gluster.org/#/c/19899/1..2

Fixed in: https://github.com/gluster/glusterfs/releases/tag/v4.0.2 

Reproducible: Always

Comment 1 Thomas Deutschmann (RETIRED) gentoo-dev

2018-06-22 11:02:14 UTC


*** This bug has been marked as a duplicate of bug 653070 ***