Описание
It was found that glusterfs server does not properly sanitize file paths in the "trusted.io-stats-dump" extended attribute which is used by the "debug/io-stats" translator. Attacker can use this flaw to create files and execute arbitrary code. To exploit this attacker would require sufficient access to modify the extended attributes of files on a gluster volume.
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | ignored | end of standard support, was needed |
| cosmic | ignored | end of life |
| devel | not-affected | 4.1.4-1 |
| disco | not-affected | 4.1.4-1 |
| eoan | not-affected | 4.1.4-1 |
| esm-apps/bionic | released | 3.13.2-1ubuntu1+esm1 |
| esm-apps/focal | not-affected | 4.1.4-1 |
| esm-apps/xenial | released | 3.7.6-1ubuntu1+esm1 |
| esm-infra-legacy/trusty | released | 3.4.2-1ubuntu1+esm1 |
| focal | not-affected | 4.1.4-1 |
Показывать по
Ссылки на источники
EPSS
6.5 Medium
CVSS2
8.8 High
CVSS3
Связанные уязвимости
It was found that glusterfs server does not properly sanitize file paths in the "trusted.io-stats-dump" extended attribute which is used by the "debug/io-stats" translator. Attacker can use this flaw to create files and execute arbitrary code. To exploit this attacker would require sufficient access to modify the extended attributes of files on a gluster volume.
It was found that glusterfs server does not properly sanitize file paths in the "trusted.io-stats-dump" extended attribute which is used by the "debug/io-stats" translator. Attacker can use this flaw to create files and execute arbitrary code. To exploit this attacker would require sufficient access to modify the extended attributes of files on a gluster volume.
It was found that glusterfs server does not properly sanitize file pat ...
It was found that glusterfs server does not properly sanitize file paths in the "trusted.io-stats-dump" extended attribute which is used by the "debug/io-stats" translator. Attacker can use this flaw to create files and execute arbitrary code. To exploit this attacker would require sufficient access to modify the extended attributes of files on a gluster volume.
EPSS
6.5 Medium
CVSS2
8.8 High
CVSS3