-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: Red Hat Gluster Storage security, bug fix, and enhancement update
Advisory ID:       RHSA-2018:2608-01
Product:           Red Hat Gluster Storage
Advisory URL:      https://access.redhat.com/errata/RHSA-2018:2608
Issue date:        2018-09-04
CVE Names:         CVE-2018-10904 CVE-2018-10907 CVE-2018-10911 
                   CVE-2018-10913 CVE-2018-10914 CVE-2018-10923 
                   CVE-2018-10926 CVE-2018-10927 CVE-2018-10928 
                   CVE-2018-10929 CVE-2018-10930 
=====================================================================

1. Summary:

Updated glusterfs packages that fix multiple security issues, several bugs,
and adds various enhancements are now available for Red Hat Gluster Storage
3.4 on Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Gluster Storage Server 3.4 on RHEL-6 - noarch, x86_64
Red Hat Storage Native Client for Red Hat Enterprise Linux 6 - x86_64

3. Description:

GlusterFS is a key building block of Red Hat Gluster Storage. It is based
on a stackable user-space design and can deliver exceptional performance
for diverse workloads. GlusterFS aggregates various storage servers over
network interconnections into one large, parallel network file system.

Security Fix(es):

* glusterfs: Unsanitized file names in debug/io-stats translator can allow
remote attackers to execute arbitrary code (CVE-2018-10904)

* glusterfs: Stack-based buffer overflow in server-rpc-fops.c allows remote
attackers to execute arbitrary code (CVE-2018-10907)

* glusterfs: I/O to arbitrary devices on storage server (CVE-2018-10923)

* glusterfs: Device files can be created in arbitrary locations
(CVE-2018-10926)

* glusterfs: File status information leak and denial of service
(CVE-2018-10927)

* glusterfs: Improper resolution of symlinks allows for privilege
escalation (CVE-2018-10928)

* glusterfs: Arbitrary file creation on storage server allows for execution
of arbitrary code (CVE-2018-10929)

* glusterfs: Files can be renamed outside volume (CVE-2018-10930)

* glusterfs: Improper deserialization in dict.c:dict_unserialize() can
allow attackers to read arbitrary memory (CVE-2018-10911)

* glusterfs: remote denial of service of gluster volumes via
posix_get_file_contents function in posix-helpers.c (CVE-2018-10914)

* glusterfs: Information Exposure in posix_get_file_contents function in
posix-helpers.c (CVE-2018-10913)

For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.

Red Hat would like to thank Michael Hanselmann (hansmi.ch) for reporting
these issues.

Additional changes:

These updated Red Hat Gluster Storage packages include numerous bug fixes
and enhancements. Space precludes documenting all of these changes in this
advisory. Users are directed to the Red Hat Gluster Storage 3.4 Release
Notes for information on the most significant of these changes:

https://doc-stage.usersys.redhat.com/documentation/en-us/red_hat_gluster_st
orage/3.4/html-single/3.4_release_notes/

All users of Red Hat Gluster Storage are advised to upgrade to these
updated packages, which provide numerous bug fixes and enhancements.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1507040 - [RFE]: Validate the RHGS <3.4 upgrade from RHEL6 to RHGS 3.4 RHEL7
1507042 - [RFE]: Validate the RHGS = 3.4 upgrade from RHEL6 to RHGS 3.4 RHEL7
1508777 - [RHEL6] rebase RHGS 3.4.0 to upstream glusterfs-3.12.2
1558509 - [RFE][RHEL6] update redhat-storage-server build for RHGS 3.4.0
1569312 - [geo-rep]: Geo-replication in FAULTY state - RHEL 6
1601298 - CVE-2018-10904 glusterfs: Unsanitized file names in debug/io-stats translator can allow remote attackers to execute arbitrary code
1601642 - CVE-2018-10907 glusterfs: Stack-based buffer overflow in server-rpc-fops.c allows remote attackers to execute arbitrary code
1601657 - CVE-2018-10911 glusterfs: Improper deserialization in dict.c:dict_unserialize() can allow attackers to read arbitrary memory
1607617 - CVE-2018-10914 glusterfs: remote denial of service of gluster volumes via posix_get_file_contents function in posix-helpers.c
1607618 - CVE-2018-10913 glusterfs:  Information Exposure in posix_get_file_contents function in posix-helpers.c
1610659 - CVE-2018-10923 glusterfs: I/O to arbitrary devices on storage server
1612658 - CVE-2018-10927 glusterfs: File status information leak and denial of service
1612659 - CVE-2018-10928 glusterfs: Improper resolution of symlinks allows for privilege escalation
1612660 - CVE-2018-10929 glusterfs: Arbitrary file creation on storage server allows for execution of arbitrary code
1612664 - CVE-2018-10930 glusterfs: Files can be renamed outside volume
1613143 - CVE-2018-10926 glusterfs: Device files can be created in arbitrary locations

6. Package List:

Red Hat Gluster Storage Server 3.4 on RHEL-6:

Source:
glusterfs-3.12.2-18.el6rhs.src.rpm
redhat-release-server-6Server-6.10.0.24.el6rhs.src.rpm
redhat-storage-server-3.4.0.0-1.el6rhs.src.rpm

noarch:
redhat-storage-server-3.4.0.0-1.el6rhs.noarch.rpm

x86_64:
glusterfs-3.12.2-18.el6rhs.x86_64.rpm
glusterfs-api-3.12.2-18.el6rhs.x86_64.rpm
glusterfs-api-devel-3.12.2-18.el6rhs.x86_64.rpm
glusterfs-cli-3.12.2-18.el6rhs.x86_64.rpm
glusterfs-client-xlators-3.12.2-18.el6rhs.x86_64.rpm
glusterfs-debuginfo-3.12.2-18.el6rhs.x86_64.rpm
glusterfs-devel-3.12.2-18.el6rhs.x86_64.rpm
glusterfs-events-3.12.2-18.el6rhs.x86_64.rpm
glusterfs-fuse-3.12.2-18.el6rhs.x86_64.rpm
glusterfs-ganesha-3.12.2-18.el6rhs.x86_64.rpm
glusterfs-geo-replication-3.12.2-18.el6rhs.x86_64.rpm
glusterfs-libs-3.12.2-18.el6rhs.x86_64.rpm
glusterfs-rdma-3.12.2-18.el6rhs.x86_64.rpm
glusterfs-server-3.12.2-18.el6rhs.x86_64.rpm
python2-gluster-3.12.2-18.el6rhs.x86_64.rpm
redhat-release-server-6Server-6.10.0.24.el6rhs.x86_64.rpm

Red Hat Storage Native Client for Red Hat Enterprise Linux 6:

Source:
glusterfs-3.12.2-18.el6.src.rpm

x86_64:
glusterfs-3.12.2-18.el6.x86_64.rpm
glusterfs-api-3.12.2-18.el6.x86_64.rpm
glusterfs-api-devel-3.12.2-18.el6.x86_64.rpm
glusterfs-cli-3.12.2-18.el6.x86_64.rpm
glusterfs-client-xlators-3.12.2-18.el6.x86_64.rpm
glusterfs-debuginfo-3.12.2-18.el6.x86_64.rpm
glusterfs-devel-3.12.2-18.el6.x86_64.rpm
glusterfs-fuse-3.12.2-18.el6.x86_64.rpm
glusterfs-libs-3.12.2-18.el6.x86_64.rpm
glusterfs-rdma-3.12.2-18.el6.x86_64.rpm
python2-gluster-3.12.2-18.el6.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2018-10904
https://access.redhat.com/security/cve/CVE-2018-10907
https://access.redhat.com/security/cve/CVE-2018-10911
https://access.redhat.com/security/cve/CVE-2018-10913
https://access.redhat.com/security/cve/CVE-2018-10914
https://access.redhat.com/security/cve/CVE-2018-10923
https://access.redhat.com/security/cve/CVE-2018-10926
https://access.redhat.com/security/cve/CVE-2018-10927
https://access.redhat.com/security/cve/CVE-2018-10928
https://access.redhat.com/security/cve/CVE-2018-10929
https://access.redhat.com/security/cve/CVE-2018-10930
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/documentation/en-us/red_hat_gluster_storage/3.4/html/3.4_release_notes/

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2018 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBW44leNzjgjWX9erEAQj1gBAApzjwGeL5WkVe0iAaqyzYlVBcWINt3oLv
A3G3iw24SOY01fxRvEvR/BSiCSZ1kDg2iayxQf7Y0dbyvaq2bfUerRuAe3Tb3u9k
wnN0Oru/+Ax5Gu5jeGNMB5EUVFKsZeJdnkVaF1jn2ppY9n1kXJCOcGYyrijUxr+/
0rjSkpGGIQRYfGdlJ7zq0RVL8hzYzztjqR2rC6//d5Rya7/N36YjqBj72qW/T6/H
oiwpfR6xRNUbAbVVzhP6/6Gd8sejV66LrMR63hEnHfQcYctwpigjsVEdR0VnDVvO
PxVakdzR23++9/IRCs22P+FzG7oq4mcy80le5ZufAVHu4xo3vfJWWC2tgpqmk5Xz
p/rCSBJpHXJLS5hPjYeJhVONvbTFEW2cyc6hXgvwvwwDfU/1w2NLB91iCYZruobf
wuHi7oA8pGA9q0Hw9oIyyS78rExkt/1HHgaMvCPdMNLT4x79qIHHUrJScKCu1GyZ
tWTspW/mTB23w5uSgZl6z/jfHA5LpPP4fZjOrOmn2cm8L4XF86vlB3pykCi8kgVw
MD0eY9Yb4Z2GbMy3oXZYh35aoVjKq6VzIuLG6jy7GPgFk82/gKZW45+haRCNT2tC
2nmSPhzpUhE1ZYcfq0nJ6n9eDEjb1icwGeZnJQZoelCAlMPGl8sFqTFubtGii607
sT7UdqSJrWo=
=hKkE
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce