CVE-2018-10928

Name	CVE-2018-10928
Description	A flaw was found in RPC request using gfs3_symlink_req in glusterfs server which allows symlink destinations to point to file paths outside of the gluster volume. An authenticated attacker could use this flaw to create arbitrary symlinks pointing anywhere on the server and execute arbitrary code on glusterfs server nodes.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
References	DLA-1510-1
NVD severity	medium
Debian Bugs	909215

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
glusterfs (PTS)	stretch	3.8.8-1	vulnerable
	buster	5.5-3	fixed
	bullseye	9.2-1	fixed
	bookworm, sid	9.3-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
glusterfs	source	jessie	3.5.2-2+deb8u4		DLA-1510-1
glusterfs	source	(unstable)	4.1.4-1			909215

Notes

[stretch] - glusterfs <no-dsa> (Minor issue; can be fixed via point release)
https://bugzilla.redhat.com/show_bug.cgi?id=1612659
https://github.com/gluster/glusterfs/commit/9ae986f18c0f251cba6bbc23eae2150a8ce0417e
When fixing this issue make sure to be complete an not open CVE-2018-14651