CVE-2018-14652
glusterfs-client: The Gluster file system through versions 3.12 and 4.1.4 is vulnerable to a buffer overflow in the 'features/index' tr...
CVE-2018-14652 is fixed in 3 products on 1 platform, first by glusterfs-client 3.13.2-1ubuntu1+esm1, released November 1, 2018. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
n/a
Medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0275
86th percentile
The Gluster file system through versions 3.12 and 4.1.4 is vulnerable to a buffer overflow in the 'features/index' translator via the code handling the 'GF_XATTR_CLRLK_CMD' xattr in the 'pl_getxattr' function. A remote authenticated attacker could exploit this on a mounted volume to cause a denial of service.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| glusterfs-client · Ubuntu 18.04.6 LTS (bionic) | 3.13.2-1ubuntu1+esm1 | glusterfs-client 3.13.2-1ubuntu1+esm1 | Nov 1, 2018 |
| glusterfs-common · Ubuntu 18.04.6 LTS (bionic) | 3.13.2-1ubuntu1+esm1 | glusterfs-common 3.13.2-1ubuntu1+esm1 | Nov 1, 2018 |
| glusterfs-server · Ubuntu 18.04.6 LTS (bionic) | 3.13.2-1ubuntu1+esm1 | glusterfs-server 3.13.2-1ubuntu1+esm1 | Nov 1, 2018 |