CVE-2018-10928

Name	CVE-2018-10928
Description	A flaw was found in RPC request using gfs3_symlink_req in glusterfs server which allows symlink destinations to point to file paths outside of the gluster volume. An authenticated attacker could use this flaw to create arbitrary symlinks pointing anywhere on the server and execute arbitrary code on glusterfs server nodes.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
References	DLA-1510-1, DLA-2806-1
Debian Bugs	909215

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
glusterfs (PTS)	stretch	3.8.8-1	vulnerable
	stretch (security)	3.8.8-1+deb9u1	fixed
	buster	5.5-3	fixed
	bullseye	9.2-1	fixed
	bookworm	10.1-3	fixed
	sid	10.1-4	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
glusterfs	source	jessie	3.5.2-2+deb8u4	DLA-1510-1
glusterfs	source	stretch	3.8.8-1+deb9u1	DLA-2806-1
glusterfs	source	(unstable)	4.1.4-1		909215

Notes

https://bugzilla.redhat.com/show_bug.cgi?id=1612659
https://github.com/gluster/glusterfs/commit/9ae986f18c0f251cba6bbc23eae2150a8ce0417e
When fixing this issue make sure to be complete an not open CVE-2018-14651