Issued:
2018-04-30
Updated:
2018-04-30

RHSA-2018:1269 - Security Advisory

Synopsis

Important: glusterfs security update

Type/Severity

Security Advisory: Important

Topic

An update for glusterfs is now available for Native Client for Red Hat Enterprise Linux 7 for Red Hat Storage and Red Hat Gluster Storage 3.3 for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

GlusterFS is a key building block of Red Hat Gluster Storage. It is based on a stackable user-space design and can deliver exceptional performance for diverse workloads. GlusterFS aggregates various storage servers over network interconnections into one large, parallel network file system.

Security Fix(es):

  • It was found that fix for CVE-2018-1088 introduced a new vulnerability in the way 'auth.allow' is implemented in glusterfs server. An unauthenticated gluster client could mount gluster storage volumes. (CVE-2018-1112)

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux Server 7 x86_64
  • Red Hat Virtualization 4 x86_64
  • Red Hat Gluster Storage Server for On-premise 3 for RHEL 7 x86_64

Fixes

  • BZ - 1570891 - CVE-2018-1112 glusterfs: auth.allow allows unauthenticated clients to mount gluster volumes (CVE-2018-1088 regression)

CVEs

References

Red Hat Enterprise Linux Server 7

SRPM
glusterfs-3.8.4-54.8.el7.src.rpm SHA-256: ac75803d45385306f37a0ae960cbe575f6d5cb754bdb59d4d3bcdbc4e9995d45
x86_64
glusterfs-3.8.4-54.8.el7.x86_64.rpm SHA-256: 832ccd763165a808e422dd161316c45717a9732739bd431b889904890b1443b4
glusterfs-api-3.8.4-54.8.el7.x86_64.rpm SHA-256: faa11af88e29602b270e03fb5443ad049cde02b7604e21b4b0c33c10c6ec349e
glusterfs-api-devel-3.8.4-54.8.el7.x86_64.rpm SHA-256: 45cfeee640b6fad02b71788d05b86536e2729cbcc509a8264b862f9c1a4fc90a
glusterfs-cli-3.8.4-54.8.el7.x86_64.rpm SHA-256: 1a3bc32106e3a919b8cd8435f09bfdd15ad114b3485e5c5592097c8cc0abd7ed
glusterfs-client-xlators-3.8.4-54.8.el7.x86_64.rpm SHA-256: ea0e66735b209f71515a797391641ce81835fe87089c0b371edb341f1c52a947
glusterfs-debuginfo-3.8.4-54.8.el7.x86_64.rpm SHA-256: c19d5a0011eda4dd9b78fd779d0b7d01e1cbc7e55a1005b7fef1b29b099b0f61
glusterfs-devel-3.8.4-54.8.el7.x86_64.rpm SHA-256: a3659dd409c7268c89abb36d4c799a6b6200eb9eba4789f0b2ef3a286313fddf
glusterfs-fuse-3.8.4-54.8.el7.x86_64.rpm SHA-256: a2647f6888b31e7a48223b8b91ab995b068006da273ac34ad0c1aa9df5978bde
glusterfs-libs-3.8.4-54.8.el7.x86_64.rpm SHA-256: 192bb84daeb0c375654f8633a41ed65febca18132ded12209dc957e9fe24cb4c
glusterfs-rdma-3.8.4-54.8.el7.x86_64.rpm SHA-256: c8fd86bf3a99e2dbf32bc7e0513e0f91e52bca1584c70a4b8dd2c207c0815399
python-gluster-3.8.4-54.8.el7.noarch.rpm SHA-256: 4429be57f00181dbb92e1003f4cacf9853ba4f9d92234e732aa9f1308a21b1d4

Red Hat Virtualization 4

SRPM
glusterfs-3.8.4-54.8.el7.src.rpm SHA-256: ac75803d45385306f37a0ae960cbe575f6d5cb754bdb59d4d3bcdbc4e9995d45
x86_64
glusterfs-3.8.4-54.8.el7.x86_64.rpm SHA-256: 832ccd763165a808e422dd161316c45717a9732739bd431b889904890b1443b4
glusterfs-api-3.8.4-54.8.el7.x86_64.rpm SHA-256: faa11af88e29602b270e03fb5443ad049cde02b7604e21b4b0c33c10c6ec349e
glusterfs-api-devel-3.8.4-54.8.el7.x86_64.rpm SHA-256: 45cfeee640b6fad02b71788d05b86536e2729cbcc509a8264b862f9c1a4fc90a
glusterfs-cli-3.8.4-54.8.el7.x86_64.rpm SHA-256: 1a3bc32106e3a919b8cd8435f09bfdd15ad114b3485e5c5592097c8cc0abd7ed
glusterfs-client-xlators-3.8.4-54.8.el7.x86_64.rpm SHA-256: ea0e66735b209f71515a797391641ce81835fe87089c0b371edb341f1c52a947
glusterfs-debuginfo-3.8.4-54.8.el7.x86_64.rpm SHA-256: c19d5a0011eda4dd9b78fd779d0b7d01e1cbc7e55a1005b7fef1b29b099b0f61
glusterfs-devel-3.8.4-54.8.el7.x86_64.rpm SHA-256: a3659dd409c7268c89abb36d4c799a6b6200eb9eba4789f0b2ef3a286313fddf
glusterfs-fuse-3.8.4-54.8.el7.x86_64.rpm SHA-256: a2647f6888b31e7a48223b8b91ab995b068006da273ac34ad0c1aa9df5978bde
glusterfs-libs-3.8.4-54.8.el7.x86_64.rpm SHA-256: 192bb84daeb0c375654f8633a41ed65febca18132ded12209dc957e9fe24cb4c
glusterfs-rdma-3.8.4-54.8.el7.x86_64.rpm SHA-256: c8fd86bf3a99e2dbf32bc7e0513e0f91e52bca1584c70a4b8dd2c207c0815399
python-gluster-3.8.4-54.8.el7.noarch.rpm SHA-256: 4429be57f00181dbb92e1003f4cacf9853ba4f9d92234e732aa9f1308a21b1d4

Red Hat Gluster Storage Server for On-premise 3 for RHEL 7

SRPM
glusterfs-3.8.4-54.8.el7rhgs.src.rpm SHA-256: b0f7f7899685c562f786f70fbdc1f2f8c6af0fb08cf35edb0e17ec9bd130a583
x86_64
glusterfs-3.8.4-54.8.el7rhgs.x86_64.rpm SHA-256: 92f1449076b1e9f3c05ad5aef7b4127ca369f8a74b615bddce028029a0f316dd
glusterfs-api-3.8.4-54.8.el7rhgs.x86_64.rpm SHA-256: 1686e5e3b6c971c5d3259ed61b1fb4852d1ca6040bd1a3c009d2dd4d0312ebae
glusterfs-api-devel-3.8.4-54.8.el7rhgs.x86_64.rpm SHA-256: e0a4f2b28fea531efeaca168fa5f4f5baf38e572d8527a80bdc692878824554d
glusterfs-cli-3.8.4-54.8.el7rhgs.x86_64.rpm SHA-256: c029d836b8da7550e0a137d81c661f2b877889c32775a18192b078a84f533193
glusterfs-client-xlators-3.8.4-54.8.el7rhgs.x86_64.rpm SHA-256: 5c6de2444aa807fe5802f7067a2e66fd363db64b72b6b49c67328bb754dfa1a7
glusterfs-debuginfo-3.8.4-54.8.el7rhgs.x86_64.rpm SHA-256: c1b97e211e90134bfef194804444c582be30a74ab553eb4c773ce89fd245ec67
glusterfs-devel-3.8.4-54.8.el7rhgs.x86_64.rpm SHA-256: cd93255ad812350e20167986896add601744b017788c26d01480cf1f21fdcbcf
glusterfs-events-3.8.4-54.8.el7rhgs.x86_64.rpm SHA-256: 53d1812c611e475c2843b09d8768db27face91727ad4be250211ead53cef35a6
glusterfs-fuse-3.8.4-54.8.el7rhgs.x86_64.rpm SHA-256: 3a87290fe7850b5efff373a2efb2d72b4f953ed5cdb15e0f91202db6d5010a5e
glusterfs-ganesha-3.8.4-54.8.el7rhgs.x86_64.rpm SHA-256: 6aba67339cc32837b3c2172e6aeb775525343b5e09a3aca8b932d015b6f2a565
glusterfs-geo-replication-3.8.4-54.8.el7rhgs.x86_64.rpm SHA-256: 5248df7e346025887c65c0c1ad9f6554ec301bdb2aed7374265981f122dc96e8
glusterfs-libs-3.8.4-54.8.el7rhgs.x86_64.rpm SHA-256: 72b9bea8fc63ca615e5ce8b20ed9f32a8b643543dc1a2408d27b287481fa8a66
glusterfs-rdma-3.8.4-54.8.el7rhgs.x86_64.rpm SHA-256: b21e208a51838432e8022c2d49118998995c16dbf05cae4ebca8558b80612306
glusterfs-resource-agents-3.8.4-54.8.el7rhgs.noarch.rpm SHA-256: 2b153aee5cde4cac1ababda3748721ce8c1d9c23ac4c896d4e41a9572e8f383a
glusterfs-server-3.8.4-54.8.el7rhgs.x86_64.rpm SHA-256: 82c62091acb5d951deab5392e6b4b499a9341bdb1eb171662feae25de7077301
python-gluster-3.8.4-54.8.el7rhgs.noarch.rpm SHA-256: 9ab2844a018e202c7f878cb89c9b9d71611812a2c2e837b7528924209585ec29

Red Hat Virtualization Host 4

SRPM
x86_64
glusterfs-debuginfo-3.8.4-54.8.el7.x86_64.rpm SHA-256: c19d5a0011eda4dd9b78fd779d0b7d01e1cbc7e55a1005b7fef1b29b099b0f61

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.