RHEL 7 : glusterfs (RHSA-2018:3432)

High Nessus Plugin ID 118583

Synopsis

The remote Red Hat host is missing one or more security updates.

Description

Updated glusterfs packages that fix multiple security issues and bugs
are now available for Red Hat Gluster Storage 3.4 on Red Hat
Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security
impact of Important. A Common Vulnerability Scoring System (CVSS) base
score, which gives a detailed severity rating, is available for each
vulnerability from the CVE link(s) in the References section.

GlusterFS is a key building block of Red Hat Gluster Storage. It is
based on a stackable user-space design and can deliver exceptional
performance for diverse workloads. GlusterFS aggregates various
storage servers over network interconnections into one large, parallel
network file system.

Security Fix(es) :

* glusterfs: glusterfs server exploitable via symlinks to relative
paths (CVE-2018-14651)

* glusterfs: Buffer overflow in 'features/locks' translator allows for
denial of service (CVE-2018-14652)

* glusterfs: Heap-based buffer overflow via 'gf_getspec_req' RPC
message (CVE-2018-14653)

* glusterfs: 'features/index' translator can create arbitrary, empty
files (CVE-2018-14654)

* glusterfs: Unlimited file creation via 'GF_XATTR_IOSTATS_DUMP_KEY'
xattr allows for denial of service (CVE-2018-14659)

* glusterfs: Repeat use of 'GF_META_LOCK_KEY' xattr allows for memory
exhaustion (CVE-2018-14660)

* glusterfs: features/locks translator passes an user-controlled
string to snprintf without a proper format string resulting in a
denial of service (CVE-2018-14661)

For more details about the security issue(s), including the impact, a
CVSS score, and other related information, refer to the CVE page(s)
listed in the References section.

Red Hat would like to thank Michael Hanselmann (hansmi.ch) for
reporting these issues.

Bug Fix(es) :

* MD5 instances are replaced with FIPS-compliant SHA256 checksums and
glusterd no longer crashes when run on a FIPS enabled machine.
(BZ#1459709)

* The flock is unlocked specifically and the status file is updated so
that the reference is not leaked to any worker or agent process. As a
result of this fix, all workers come up without fail. (BZ#1623749)

* All HTIME index files are checked for the specified start and end
times, and the History API does not fail when multiple HTIME files
exist. (BZ# 1627639)

* After upgrading to Red Hat Gluster Storage 3.4 from earlier versions
of Red Hat Gluster Storage, the volume size displayed by the df
command was smaller than the actual volume size. This has been fixed
and the df command now shows the correct size for all volumes.
(BZ#1630997)

* The algorithm to disable the eager-lock is modified and it disables
only when multiple write operations are trying to modify a file at the
same time. This led to performance improvement while a write operation
is performed on a file irrespective of the number of times it is
opened at the same time for a read operation. (BZ#1630688)

* heal-info does not consider the presence of dirty markers as an
indication of split-brain and does not display these entries to be in
a split-brain state. (BZ#1610743)

All users of Red Hat Gluster Storage are advised to upgrade to these
updated packages, which provide numerous bug fixes and enhancements.

Solution

Update the affected packages.

See Also

https://access.redhat.com/errata/RHSA-2018:3432

https://access.redhat.com/security/cve/cve-2018-14651

https://access.redhat.com/security/cve/cve-2018-14652

https://access.redhat.com/security/cve/cve-2018-14653

https://access.redhat.com/security/cve/cve-2018-14654

https://access.redhat.com/security/cve/cve-2018-14659

https://access.redhat.com/security/cve/cve-2018-14660

https://access.redhat.com/security/cve/cve-2018-14661

Plugin Details

Severity: High

ID: 118583

File Name: redhat-RHSA-2018-3432.nasl

Version: 1.6

Type: local

Agent: unix

Published: 2018/11/01

Modified: 2019/01/02

Dependencies: 12634

Risk Information

Risk Factor: High

CVSS v2.0

Base Score: 8.5

Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:C/A:C

CVSS v3.0

Base Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:glusterfs, p-cpe:/a:redhat:enterprise_linux:glusterfs-api, p-cpe:/a:redhat:enterprise_linux:glusterfs-api-devel, p-cpe:/a:redhat:enterprise_linux:glusterfs-cli, p-cpe:/a:redhat:enterprise_linux:glusterfs-client-xlators, p-cpe:/a:redhat:enterprise_linux:glusterfs-debuginfo, p-cpe:/a:redhat:enterprise_linux:glusterfs-devel, p-cpe:/a:redhat:enterprise_linux:glusterfs-events, p-cpe:/a:redhat:enterprise_linux:glusterfs-fuse, p-cpe:/a:redhat:enterprise_linux:glusterfs-ganesha, p-cpe:/a:redhat:enterprise_linux:glusterfs-geo-replication, p-cpe:/a:redhat:enterprise_linux:glusterfs-libs, p-cpe:/a:redhat:enterprise_linux:glusterfs-rdma, p-cpe:/a:redhat:enterprise_linux:glusterfs-resource-agents, p-cpe:/a:redhat:enterprise_linux:glusterfs-server, p-cpe:/a:redhat:enterprise_linux:python2-gluster, p-cpe:/a:redhat:enterprise_linux:redhat-storage-server, cpe:/o:redhat:enterprise_linux:7

Patch Publication Date: 2018/10/31

Reference Information

CVE: CVE-2018-14651, CVE-2018-14652, CVE-2018-14653, CVE-2018-14654, CVE-2018-14659, CVE-2018-14660, CVE-2018-14661

RHSA: 2018:3432