Total vulnerabilities in the database
It was found that glusterfs server does not properly sanitize file paths in the "trusted.io-stats-dump" extended attribute which is used by the "debug/io-stats" translator. Attacker can use this flaw to create files and execute arbitrary code. To exploit this attacker would require sufficient access to modify the extended attributes of files on a gluster volume.
| Software | From | Fixed in |
|---|---|---|
| gluster / glusterfs | 3.12.0 | 3.12.14 |
| gluster / glusterfs | 4.1.0 | 4.1.8 |
| redhat / enterprise_linux_server | 7.0 | 7.0.x |
| redhat / enterprise_linux_server | 6.0 | 6.0.x |
| redhat / virtualization_host | 4.0 | 4.0.x |
| debian / debian_linux | 8.0 | 8.0.x |
| debian / debian_linux | 9.0 | 9.0.x |
| opensuse / leap | 15.1 | 15.1.x |