CVE-2018-1112 — glusterfs: auth.allow allows unauthenticated clients to mount gluster volumes (CVE-2018-1088 regression)

Back Back to CVE browser

HIGH

glusterfs: auth.allow allows unauthenticated clients to mount gluster volumes (CVE-2018-1088 regression)

Published Apr 25, 2018

8.8

HIGH

CVSS 3.0

EPSS 2.39%

Description

glusterfs server before versions 3.10.12, 4.0.2 is vulnerable when using 'auth.allow' option which allows any unauthenticated gluster client to connect from any network to mount gluster storage volumes. NOTE: this vulnerability exists because of a CVE-2018-1088 regression.

Affected products

Vendor n/a Product Glusterfs Default
n/a
- Version
  glusterfs 3.10.12
  Status
  affected
  Constraints
  -
- Version
  glusterfs 4.0.2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Glusterfs

n/a

Version	Status	Constraints
glusterfs 3.10.12	affected	-
glusterfs 4.0.2	affected	-

Native Client for RHEL 6 for Red Hat Storage

glusterfs-0:3.8.4-54.9.el6

Fixed · RHSA-2018:1268
Native Client for RHEL 7 for Red Hat Storage

glusterfs-0:3.8.4-54.8.el7

Fixed · RHSA-2018:1269
Red Hat Gluster Storage 3.3 for RHEL 6

glusterfs-0:3.8.4-54.9.el6rhs

Fixed · RHSA-2018:1268
Red Hat Gluster Storage 3.3 for RHEL 7

glusterfs-0:3.8.4-54.8.el7rhgs

Fixed · RHSA-2018:1269
Red Hat Virtualization 4 for Red Hat Enterprise Linux 7

glusterfs-0:3.8.4-54.8.el7

Fixed · RHSA-2018:1269
Red Hat Enterprise Linux 6

glusterfs

Not affected
Red Hat Enterprise Linux 7

glusterfs

Not affected
Red Hat Enterprise Linux 8

glusterfs

Not affected

Product	Package	State	Advisory
Native Client for RHEL 6 for Red Hat Storage	glusterfs-0:3.8.4-54.9.el6	Fixed	RHSA-2018:1268
Native Client for RHEL 7 for Red Hat Storage	glusterfs-0:3.8.4-54.8.el7	Fixed	RHSA-2018:1269
Red Hat Gluster Storage 3.3 for RHEL 6	glusterfs-0:3.8.4-54.9.el6rhs	Fixed	RHSA-2018:1268
Red Hat Gluster Storage 3.3 for RHEL 7	glusterfs-0:3.8.4-54.8.el7rhgs	Fixed	RHSA-2018:1269
Red Hat Virtualization 4 for Red Hat Enterprise Linux 7	glusterfs-0:3.8.4-54.8.el7	Fixed	RHSA-2018:1269
Red Hat Enterprise Linux 6	glusterfs	Not affected	n/a
Red Hat Enterprise Linux 7	glusterfs	Not affected	n/a
Red Hat Enterprise Linux 8	glusterfs	Not affected	n/a

Remediation

Red Hat statement

This vulnerability affects gluster servers that use 'auth.allow' to restrict access to gluster volumes. Gluster servers using TLS to authenticate gluster clients are not affected by this. This vulnerability allows any client to connect to any gluster volume which only uses auth.allow to restrict access. This issue did not affect the versions of glusterfs as shipped with Red Hat Enterprise Linux 6 and 7 because only gluster client is shipped in these products. CVE-2018-1112 affects glusterfs-server package as shipped with Red Hat Gluster Storage 3.

Red Hat mitigation

1. Use TLS Authentication to authenticate gluster clients to limit access to gluster storage volumes 2. The gluster server should be on LAN, firewalled to trusted systems, and not reachable from public networks.

Metrics

2.39% 0.02392

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.02392

Score over time

2021–2026

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (20 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	2.39% (0.02392)	83.37th	v5 (v2026.06.15)
Jun 15, 2026	2.38% (0.02384)	81.67th	v5 (v2026.06.15)
Nov 21, 2025	1.95% (0.01953)	82.92th	v4 (v2025.03.14)
Mar 30, 2025	3.25% (0.03253)	85.98th	v4 (v2025.03.14)
Mar 29, 2025	22.50% (0.22504)	93.28th	v4 (v2025.03.14)
Mar 17, 2025	3.38% (0.03376)	86.54th	v4 (v2025.03.14)
Dec 12, 2024	0.52% (0.00523)	77.66th	v3 (v2023.03.01)
Feb 8, 2024	0.52% (0.00523)	76.20th	v3 (v2023.03.01)
Sep 16, 2023	0.52% (0.00523)	74.10th	v3 (v2023.03.01)
Jul 8, 2023	0.50% (0.00504)	73.23th	v3 (v2023.03.01)
May 8, 2023	0.55% (0.00549)	74.07th	v3 (v2023.03.01)
Apr 19, 2023	0.50% (0.00504)	72.94th	v3 (v2023.03.01)
Mar 7, 2023	0.35% (0.00349)	67.28th	v3 (v2023.03.01)
Mar 6, 2023	11.57% (0.11569)	95.06th	v2 (v2022.01.01)
Apr 1, 2022	11.57% (0.11569)	94.67th	v2 (v2022.01.01)
Feb 4, 2022	11.57% (0.11569)	88.81th	v2 (v2022.01.01)
Feb 3, 2022	6.21% (0.06208)	81.93th	v1
Jan 6, 2022	6.21% (0.06208)	81.75th	v1
Sep 1, 2021	6.21% (0.06208)	89.66th	v1
Apr 14, 2021	6.21% (0.06208)	0.00th	v1

Weaknesses (1)

CWE-287

Improper Authentication

References (10)

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00035.html
vendor-advisoryx_refsource_SUSE
https://access.redhat.com/articles/3422521
x_refsource_CONFIRMThird Party Advisory
https://access.redhat.com/errata/RHSA-2018:1268
vendor-advisoryx_refsource_REDHATThird Party Advisory
https://access.redhat.com/errata/RHSA-2018:1269
vendor-advisoryx_refsource_REDHATThird Party Advisory
https://access.redhat.com/security/cve/CVE-2018-1112
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1570891
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1112
x_refsource_CONFIRMIssue TrackingThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-1112
https://review.gluster.org/#/c/19899/1..2
x_refsource_CONFIRMVendor Advisory
https://www.cve.org/CVERecord?id=CVE-2018-1112

Link	Providers	Tags
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00035.html		vendor-advisoryx_refsource_SUSE
https://access.redhat.com/articles/3422521		x_refsource_CONFIRMThird Party Advisory
https://access.redhat.com/errata/RHSA-2018:1268		vendor-advisoryx_refsource_REDHATThird Party Advisory
https://access.redhat.com/errata/RHSA-2018:1269		vendor-advisoryx_refsource_REDHATThird Party Advisory
https://access.redhat.com/security/cve/CVE-2018-1112		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1570891		Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1112		x_refsource_CONFIRMIssue TrackingThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-1112
https://review.gluster.org/#/c/19899/1..2		x_refsource_CONFIRMVendor Advisory
https://www.cve.org/CVERecord?id=CVE-2018-1112