CoreCVE
Back

MEDIUM

glusterfs: Information Exposure in posix_get_file_contents function in posix-helpers.c

Published Sep 4, 2018

Description

An information disclosure vulnerability was discovered in glusterfs server. An attacker could issue a xattr request via glusterfs FUSE to determine the existence of any file.

Affected products

Remediation

Red Hat statement

This issue did not affect Red Hat Enterprise Linux 6 and 7 as the flaw is present in glusterfs-server, which is not shipped there. This flaw affects glusterfs versions included in Red Hat Virtualization 4 Hypervisor. However, in recommended configurations, the vulnerability is only exposed to hypervisor administrators and can not be exploited from virtual machines or other hosts on the network.

Red Hat mitigation

SELinux mitigates this issue on Red Hat Gluster Storage 3. SELinux should be in enforcing mode only as permissive mode does not block attacks.

Weaknesses (2)

CWE-200

Exposure of Sensitive Information

CWE-209

References (14)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published Sep 4, 2018
Updated Aug 5, 2024
Reserved May 9, 2018
Link CVE-2018-10913
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2018-10913
Red Hat
Severity Low
Public date Sep 4, 2018
Links CVE-2018-10913 - Bugzilla
ENISA EUVD
Assigner redhat
Published Sep 4, 2018
Updated Aug 5, 2024
Exploited since n/a
Link EUVD-2018-2968
EUVD-2018-2968