Deserialization of Untrusted Data Affecting glusterfs-cli package, versions <0:3.12.2-18.el7


Severity

Recommended
0.0
medium
0
10

Based on Red Hat Enterprise Linux security rating.

Threat Intelligence

EPSS
0.3% (70th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Deserialization of Untrusted Data vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-RHEL7-GLUSTERFSCLI-7965040
  • published14 Sept 2024
  • disclosed4 Sept 2018

Introduced: 4 Sep 2018

CVE-2018-10911  (opens in a new tab)
CWE-502  (opens in a new tab)
CWE-190  (opens in a new tab)
CWE-200  (opens in a new tab)

How to fix?

Upgrade RHEL:7 glusterfs-cli to version 0:3.12.2-18.el7 or higher.
This issue was patched in RHSA-2018:3242.

NVD Description

Note: Versions mentioned in the description apply only to the upstream glusterfs-cli package and not the glusterfs-cli package as distributed by RHEL. See How to fix? for RHEL:7 relevant fixed versions and status.

A flaw was found in the way dic_unserialize function of glusterfs does not handle negative key length values. An attacker could use this flaw to read memory from other locations into the stored dict value.

CVSS Scores

version 3.1