CVE-2018-10907

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2018-10907
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-10907.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2018-10907
Downstream
Related
Published
2018-09-04T13:29:11.017Z
Modified
2026-03-15T22:17:16.567671Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

It was found that glusterfs server is vulnerable to multiple stack based buffer overflows due to functions in server-rpc-fopc.c allocating fixed size buffers using 'alloca(3)'. An authenticated attacker could exploit this by mounting a gluster volume and sending a string longer that the fixed buffer size to cause crash or potential code execution.

References

Affected packages

Git / github.com/gluster/glusterfs

Affected ranges

Type
GIT
Repo
https://github.com/gluster/glusterfs
Events
Introduced
c8c56b9a53471792a126f8e46f32ce7190eac10c
Fixed
fe5b6bc8522b3539a97765b243ad37ef227c05b6
Introduced
b4f4480094b7c3ebda3319df0c3f96efd08b2176
Fixed
deafd5a4f8440fa2a6f54595722e6fd1d4b6ed55
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
4a85a221c92f422dedde62832e6cd6e66cae2722
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
3fadf5cc41d5ea3195d2228d23e890f27fc22f87
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
a92e9e8e8ae6b97db8e0c1fb8268aef734ab48b4
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
2e1e4168ab6b6b3ebe9e3dfb227fb7631e5c1aa4
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
c6d4289dad6622e311c312b609a52106909f7d74
Database specific 
{
    "versions": [
        {
            "introduced": "3.12.0"
        },
        {
            "fixed": "3.12.14"
        },
        {
            "introduced": "4.1.0"
        },
        {
            "fixed": "4.1.4"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "4.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "6.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "7.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0"
        }
    ]
}

Affected versions

v3.*
v3.12.0
v3.12.1
v3.12.10
v3.12.11
v3.12.12
v3.12.13
v3.12.2
v3.12.3
v3.12.4
v3.12.5
v3.12.6
v3.12.7
v3.12.8
v3.12.9
v4.*
v4.1.0
v4.1.1
v4.1.2
v4.1.3

Database specific

unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "15.1"
            }
        ]
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-10907.json"