FEDORA-2018-4e660226e7 — security update for glusterfs

stable

glusterfs-4.1.4-1.fc28

FEDORA-2018-4e660226e7 created by kkeithle 4 years ago for Fedora 28

4.1.4 GA Security Fix for CVE-2018-10904 Security Fix for CVE-2018-10907 Security Fix for CVE-2018-10911 Security Fix for CVE-2018-10913 Security Fix for CVE-2018-10914 Security Fix for CVE-2018-10923 Security Fix for CVE-2018-10926 Security Fix for CVE-2018-10927 Security Fix for CVE-2018-10928 Security Fix for CVE-2018-10929 Security Fix for CVE-2018-10930

missing /run/gluster/metrics, see bz#1624006

How to install

sudo dnf upgrade --refresh --advisory=FEDORA-2018-4e660226e7

This update has been submitted for testing by kkeithle.

4 years ago

This update has obsoleted glusterfs-4.1.3-2.fc28, and has inherited its bugs and notes.

4 years ago

This update has been pushed to testing.

4 years ago

besser82 commented & provided feedback 4 years ago

karma

Works great! LGTM! =)

cserpentis commented & provided feedback 4 years ago

karma

works for me

samoht0 commented & provided feedback 4 years ago

karma

no regressions noted

This update has been submitted for batched by bodhi.

4 years ago

samoht0 commented & provided feedback 4 years ago

karma

no regressions noted

This update has been submitted for stable by bodhi.

4 years ago

This update has been pushed to stable.

4 years ago

Please login to add feedback.

Metadata

Type

security

Karma

Signed

Content Type

RPM

Test Gating

ignored

Builds

glusterfs-4.1.4-1.fc28

Settings

Unstable by Karma

-3

Stable by Karma

Stable by Time

disabled

Dates

submitted

4 years ago

in testing

4 years ago

in stable

4 years ago

BZ#1614769 Typo in build flag

BZ#1624006 /var/run/gluster/metrics/ wasn't created automatically

BZ#1625067 CVE-2018-10927 glusterfs: File status information leak and denial of service [fedora-all]

BZ#1625068 CVE-2018-10928 glusterfs: Improper resolution of symlinks allows for privilege escalation [fedora-all]

BZ#1625069 CVE-2018-10929 glusterfs: Arbitrary file creation on storage server allows for execution of arbitrary code [fedora-all]

BZ#1625074 CVE-2018-10913 glusterfs: Information Exposure in posix_get_file_contents function in posix-helpers.c [fedora-all]

BZ#1625075 CVE-2018-10914 glusterfs: remote denial of service of gluster volumes via posix_get_file_contents function in posix-helpers.c [fedora-all]

BZ#1625079 CVE-2018-10911 glusterfs: Improper deserialization in dict.c:dict_unserialize() can allow attackers to read arbitrary memory [fedora-all]

BZ#1625080 CVE-2018-10907 glusterfs: Stack-based buffer overflow in server-rpc-fops.c allows remote attackers to execute arbitrary code [fedora-all]

BZ#1625085 CVE-2018-10930 glusterfs: Files can be renamed outside volume [fedora-all]

BZ#1625086 CVE-2018-10926 glusterfs: Device files can be created in arbitrary locations [fedora-all]

BZ#1625091 CVE-2018-10923 glusterfs: I/O to arbitrary devices on storage server [fedora-all]

BZ#1625103 CVE-2018-10904 glusterfs: Unsanitized file names in debug/io-stats translator can allow remote attackers to execute arbitrary code [fedora-all]

glusterfs-4.1.4-1.fc28

Automated Test Results

ignored