CVE-2018-10841

Name	CVE-2018-10841
Description	glusterfs is vulnerable to privilege escalation on gluster server nodes. An authenticated gluster client via TLS could use gluster cli with --remote-host command to add it self to trusted storage pool and perform privileged gluster operations like adding other machines to trusted storage pool, start, stop, and delete volumes.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-2806-1
Debian Bugs	901968

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
glusterfs (PTS)	buster	5.5-3	fixed
	bullseye	9.2-1	fixed
	bookworm	10.3-5	fixed
	sid, trixie	11.1-4	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
glusterfs	source	jessie	(not affected)
glusterfs	source	stretch	3.8.8-1+deb9u1	DLA-2806-1
glusterfs	source	(unstable)	4.1.2-1		901968

Notes

[jessie] - glusterfs <not-affected> (vulnerable code not present)
https://review.gluster.org/#/c/20328/
http://git.gluster.org/cgit/glusterfs.git/commit/?id=e8d928e34680079e42be6947ffacc4ddd7defca2