FEDORA-2018-0e6323ff08 — security update for glusterfs

obsolete

glusterfs-4.1.4-1.fc29

FEDORA-2018-0e6323ff08 created by kkeithle 6 years ago for Fedora 29

4.1.4 GA Security Fix for CVE-2018-10904 Security Fix for CVE-2018-10907 Security Fix for CVE-2018-10911 Security Fix for CVE-2018-10913 Security Fix for CVE-2018-10914 Security Fix for CVE-2018-10923 Security Fix for CVE-2018-10926 Security Fix for CVE-2018-10927 Security Fix for CVE-2018-10928 Security Fix for CVE-2018-10929 Security Fix for CVE-2018-10930

missing /run/gluster/metrics, see bz#1624006

This update has been submitted for testing by kkeithle.

6 years ago

This update has obsoleted glusterfs-4.1.3-2.fc29, and has inherited its bugs and notes.

6 years ago

This update has been pushed to testing.

6 years ago

pwalter commented & provided feedback 6 years ago

karma

Works

cserpentis commented & provided feedback 6 years ago

karma

works for me

This update has been obsoleted by glusterfs-4.1.5-1.fc29.

6 years ago

Please login to add feedback.

Metadata

Type

security

Karma

Signed

Content Type

RPM

Test Gating

ignored

Builds

glusterfs-4.1.4-1.fc29

Settings

Unstable by Karma

-3

Stable by Karma

Stable by Time

disabled

Dates

submitted

6 years ago

in testing

6 years ago

BZ#1614769 Typo in build flag

BZ#1624006 /var/run/gluster/metrics/ wasn't created automatically

BZ#1625067 CVE-2018-10927 glusterfs: File status information leak and denial of service [fedora-all]

BZ#1625068 CVE-2018-10928 glusterfs: Improper resolution of symlinks allows for privilege escalation [fedora-all]

BZ#1625069 CVE-2018-10929 glusterfs: Arbitrary file creation on storage server allows for execution of arbitrary code [fedora-all]

BZ#1625074 CVE-2018-10913 glusterfs: Information Exposure in posix_get_file_contents function in posix-helpers.c [fedora-all]

BZ#1625075 CVE-2018-10914 glusterfs: remote denial of service of gluster volumes via posix_get_file_contents function in posix-helpers.c [fedora-all]

BZ#1625079 CVE-2018-10911 glusterfs: Improper deserialization in dict.c:dict_unserialize() can allow attackers to read arbitrary memory [fedora-all]

BZ#1625080 CVE-2018-10907 glusterfs: Stack-based buffer overflow in server-rpc-fops.c allows remote attackers to execute arbitrary code [fedora-all]

BZ#1625085 CVE-2018-10930 glusterfs: Files can be renamed outside volume [fedora-all]

BZ#1625086 CVE-2018-10926 glusterfs: Device files can be created in arbitrary locations [fedora-all]

BZ#1625091 CVE-2018-10923 glusterfs: I/O to arbitrary devices on storage server [fedora-all]

BZ#1625103 CVE-2018-10904 glusterfs: Unsanitized file names in debug/io-stats translator can allow remote attackers to execute arbitrary code [fedora-all]

glusterfs-4.1.4-1.fc29

Automated Test Results

ignored