-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: glusterfs security and bug fix update Advisory ID: RHSA-2018:3432-01 Product: Red Hat Gluster Storage Advisory URL: https://access.redhat.com/errata/RHSA-2018:3432 Issue date: 2018-10-31 CVE Names: CVE-2018-14651 CVE-2018-14652 CVE-2018-14653 CVE-2018-14654 CVE-2018-14659 CVE-2018-14660 CVE-2018-14661 ==================================================================== 1. Summary: Updated glusterfs packages that fix multiple security issues and bugs are now available for Red Hat Gluster Storage 3.4 on Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Gluster Storage Server 3.4 on RHEL-7 - noarch, x86_64 Red Hat Storage Native Client for Red Hat Enterprise Linux 7 - x86_64 3. Description: GlusterFS is a key building block of Red Hat Gluster Storage. It is based on a stackable user-space design and can deliver exceptional performance for diverse workloads. GlusterFS aggregates various storage servers over network interconnections into one large, parallel network file system. Security Fix(es): * glusterfs: glusterfs server exploitable via symlinks to relative paths (CVE-2018-14651) * glusterfs: Buffer overflow in "features/locks" translator allows for denial of service (CVE-2018-14652) * glusterfs: Heap-based buffer overflow via "gf_getspec_req" RPC message (CVE-2018-14653) * glusterfs: "features/index" translator can create arbitrary, empty files (CVE-2018-14654) * glusterfs: Unlimited file creation via "GF_XATTR_IOSTATS_DUMP_KEY" xattr allows for denial of service (CVE-2018-14659) * glusterfs: Repeat use of "GF_META_LOCK_KEY" xattr allows for memory exhaustion (CVE-2018-14660) * glusterfs: features/locks translator passes an user-controlled string to snprintf without a proper format string resulting in a denial of service (CVE-2018-14661) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank Michael Hanselmann (hansmi.ch) for reporting these issues. Bug Fix(es): * MD5 instances are replaced with FIPS-compliant SHA256 checksums and glusterd no longer crashes when run on a FIPS enabled machine. (BZ#1459709) * The flock is unlocked specifically and the status file is updated so that the reference is not leaked to any worker or agent process. As a result of this fix, all workers come up without fail. (BZ#1623749) * All HTIME index files are checked for the specified start and end times, and the History API does not fail when multiple HTIME files exist. (BZ#1627639) * After upgrading to Red Hat Gluster Storage 3.4 from earlier versions of Red Hat Gluster Storage, the volume size displayed by the df command was smaller than the actual volume size. This has been fixed and the df command now shows the correct size for all volumes. (BZ#1630997) * The algorithm to disable the eager-lock is modified and it disables only when multiple write operations are trying to modify a file at the same time. This led to performance improvement while a write operation is performed on a file irrespective of the number of times it is opened at the same time for a read operation. (BZ#1630688) * heal-info does not consider the presence of dirty markers as an indication of split-brain and does not display these entries to be in a split-brain state. (BZ#1610743) All users of Red Hat Gluster Storage are advised to upgrade to these updated packages, which provide numerous bug fixes and enhancements. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1610743 - Directory is incorrectly reported as in split-brain when dirty marking is there 1618221 - If a node disconnects during volume delete, it assumes deleted volume as a freshly created volume when it is back online 1619627 - Add performance options to virt profile 1622649 - [RHEL7] Some of the Posix compliance tests are failing on gluster mount 1623749 - Geo-rep: Few workers fails to start with out any failure 1623874 - IO errors on block device post rebooting one brick node 1624444 - Fail volume stop operation in case brick detach request fails 1625622 - [Disperse] Improve log messages for EC volume while getting/setting xattrs and finding good child to wind 1626780 - sas workload job getting stuck after sometime 1627098 - RFE: make fuse dumping available as mount option 1627617 - SAS job aborts complaining about file doesn't exist 1627639 - libgfchangelog: History API fails 1630688 - Low Random write IOPS in VM in RHHI 2.0 1631329 - rpc marks brick disconnected from glusterd 1631372 - glusterfsd keeping fd open in index xlator after stop the volume 1631576 - CVE-2018-14654 glusterfs: "features/index" translator can create arbitrary, empty files 1632557 - CVE-2018-14651 glusterfs: glusterfs server exploitable via symlinks to relative paths 1632974 - CVE-2018-14652 glusterfs: Buffer overflow in "features/locks" translator allows for denial of service 1633431 - CVE-2018-14653 glusterfs: Heap-based buffer overflow via "gf_getspec_req" RPC message 1635926 - CVE-2018-14660 glusterfs: Repeat use of "GF_META_LOCK_KEY" xattr allows for memory exhaustion 1635929 - CVE-2018-14659 glusterfs: Unlimited file creation via "GF_XATTR_IOSTATS_DUMP_KEY" xattr allows for denial of service 1636880 - CVE-2018-14661 glusterfs: features/locks translator passes an user-controlled string to snprintf without a proper format string resulting in a denial of service 1636902 - "gluster vol heal info" is hung on Distributed-Replicated ( Arbiter ) 1640135 - Wrong version number in /etc/redhat-storage-release 1641489 - [Brick-Mux] gluster vol stop fails with Error : Request timed out. 1641586 - spec: wrong release number for RHGS 3.4.1 in /usr/share/glusterfs/release 1643355 - [RHEL7] update with entitlement certificate for RHEL 7.6 6. Package List: Red Hat Gluster Storage Server 3.4 on RHEL-7: Source: glusterfs-3.12.2-25.el7rhgs.src.rpm redhat-storage-server-3.4.1.0-1.el7rhgs.src.rpm noarch: glusterfs-resource-agents-3.12.2-25.el7rhgs.noarch.rpm redhat-storage-server-3.4.1.0-1.el7rhgs.noarch.rpm x86_64: glusterfs-3.12.2-25.el7rhgs.x86_64.rpm glusterfs-api-3.12.2-25.el7rhgs.x86_64.rpm glusterfs-api-devel-3.12.2-25.el7rhgs.x86_64.rpm glusterfs-cli-3.12.2-25.el7rhgs.x86_64.rpm glusterfs-client-xlators-3.12.2-25.el7rhgs.x86_64.rpm glusterfs-debuginfo-3.12.2-25.el7rhgs.x86_64.rpm glusterfs-devel-3.12.2-25.el7rhgs.x86_64.rpm glusterfs-events-3.12.2-25.el7rhgs.x86_64.rpm glusterfs-fuse-3.12.2-25.el7rhgs.x86_64.rpm glusterfs-ganesha-3.12.2-25.el7rhgs.x86_64.rpm glusterfs-geo-replication-3.12.2-25.el7rhgs.x86_64.rpm glusterfs-libs-3.12.2-25.el7rhgs.x86_64.rpm glusterfs-rdma-3.12.2-25.el7rhgs.x86_64.rpm glusterfs-server-3.12.2-25.el7rhgs.x86_64.rpm python2-gluster-3.12.2-25.el7rhgs.x86_64.rpm Red Hat Storage Native Client for Red Hat Enterprise Linux 7: Source: glusterfs-3.12.2-25.el7.src.rpm x86_64: glusterfs-3.12.2-25.el7.x86_64.rpm glusterfs-api-3.12.2-25.el7.x86_64.rpm glusterfs-api-devel-3.12.2-25.el7.x86_64.rpm glusterfs-cli-3.12.2-25.el7.x86_64.rpm glusterfs-client-xlators-3.12.2-25.el7.x86_64.rpm glusterfs-debuginfo-3.12.2-25.el7.x86_64.rpm glusterfs-devel-3.12.2-25.el7.x86_64.rpm glusterfs-fuse-3.12.2-25.el7.x86_64.rpm glusterfs-libs-3.12.2-25.el7.x86_64.rpm glusterfs-rdma-3.12.2-25.el7.x86_64.rpm python2-gluster-3.12.2-25.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2018-14651 https://access.redhat.com/security/cve/CVE-2018-14652 https://access.redhat.com/security/cve/CVE-2018-14653 https://access.redhat.com/security/cve/CVE-2018-14654 https://access.redhat.com/security/cve/CVE-2018-14659 https://access.redhat.com/security/cve/CVE-2018-14660 https://access.redhat.com/security/cve/CVE-2018-14661 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2018 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBW9lrctzjgjWX9erEAQjOtBAAkDi+U2WwzpD859xKP6rnq85jCrT7Pf4L boqirsqpEeSZu1Ilm8XAVS8TYtweFDmMrQ7QC9ecl8pS4P4a3IsTaWO9KP5Eo1rw GXhLnd4fzrde5UumDYgqgwWOwEu2Hc71P4tswJwrZi0bcqii2g0xvveZJoYbPOgg 26IIbRH1FSn7fXZfMBsCIcs8XlK11q0gqqvIiY66SCvECEvK0Ot80pwO1SIS5eh8 ZR3nZxqE6ccl3mcE8dOAh21bbkVpm/ArIjkSwm78dRbBviCoEuVFfOq4a/lF9G/5 cBB46AgD4QRDATUT9hCPVi9hSk22yqJRaM9ZG9apbX61WpEhi8OljRaYUtdoxAr7 zT5hHOvCFdvXcTaT0ucHGMBljSBmoiKfohO9DNrwR/rtVmHC3BDJxgK7BUM1mp9i Mg1FTMoc0pwgqABRa1QzRRoWS5MNeJ0f8DzOZtGsJMfIZMaPA5bIVz0/JhbOrR63 U0fT4yNz//5lOLwPobqHvtUJm+XUoxTIE1+O+niUxlvtOUSteXL50ckISOpzTLwQ t9++v+ojNlvJZCOBtQw6HJbI9c5ISUrcnTKEA+yZkU9Ld8dZmEx5PMpVbiz5ha3r Yul9h4iFU02vy5UCaAKQ6MoSKmGMwX9kFZWy6FXdzvgqWaGS+7+rDT08ujhb8gj8 44av7U1M3JU=ovxw -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce