Total vulnerabilities in the database
The Gluster file system through versions 4.1.4 and 3.1.2 is vulnerable to a denial of service attack via use of the 'GF_XATTR_IOSTATS_DUMP_KEY' xattr. A remote, authenticated attacker could exploit this by mounting a Gluster volume and repeatedly calling 'setxattr(2)' to trigger a state dump and create an arbitrary number of files in the server's runtime directory.
| Software | From | Fixed in |
|---|---|---|
| redhat / gluster_file_system | 4.1.0 | 4.1.4.x |
| redhat / gluster_file_system | 3.0.0 | 3.1.2.x |
| debian / debian_linux | 8.0 | 8.0.x |
| debian / debian_linux | 9.0 | 9.0.x |
| redhat / enterprise_linux_server | 7.0 | 7.0.x |
| redhat / enterprise_linux_server | 6.0 | 6.0.x |
| redhat / virtualization | 4.0 | 4.0.x |
| redhat / virtualization_host | 4.0 | 4.0.x |