CVE-2018-10928

Name	CVE-2018-10928
Description	A flaw was found in RPC request using gfs3_symlink_req in glusterfs server which allows symlink destinations to point to file paths outside of the gluster volume. An authenticated attacker could use this flaw to create arbitrary symlinks pointing anywhere on the server and execute arbitrary code on glusterfs server nodes.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
References	DLA-1510-1
NVD severity	medium (attack range: remote)
Debian Bugs	909215

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
glusterfs (PTS)	jessie	3.5.2-2+deb8u3	vulnerable
	jessie (security)	3.5.2-2+deb8u5	fixed
	stretch	3.8.8-1	vulnerable
	buster, sid	5.5-3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
glusterfs	source	(unstable)	4.1.4-1	medium		909215
glusterfs	source	jessie	3.5.2-2+deb8u4	medium	DLA-1510-1

Notes

https://bugzilla.redhat.com/show_bug.cgi?id=1612659
https://github.com/gluster/glusterfs/commit/9ae986f18c0f251cba6bbc23eae2150a8ce0417e
When fixing this issue make sure to be complete an not open CVE-2018-14651