CVE-2018-10926 Path traversal in glusterfs
An authenticated attacker can exploit a path traversal flaw in GlusterFS to write files to arbitrary locations and execute code on the server.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-10926?
CVE-2018-10926 is a high-severity path traversal vulnerability in Debian Debian Linux, published on 4 Sep 2018. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A flaw was found in RPC request using gfs3_mknod_req supported by glusterfs server. An authenticated attacker could use this flaw to write files to an arbitrary location via path traversal and execute arbitrary code on a glusterfs server node.
Which versions are affected by CVE-2018-10926?
It affects 6 products.
Products include Debian Debian Linux, Gluster Glusterfs, Opensuse Leap, Redhat Enterprise Linux, Redhat Enterprise Linux Server, Redhat Virtualization Host.
How do I fix CVE-2018-10926?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2018-10926 being exploited?
There is no known exploitation of CVE-2018-10926 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2018-10926, GHSA-pjmw-qwj2-f9fg, UBUNTU-CVE-2018-10926.