A flaw was found in RPC request using gfs3_rename_req in glusterfs server. An authenticated attacker could use this flaw to write to a destination outside the gluster volume.

A flaw was found in RPC request using gfs3_rename_req in glusterfs server. An authenticated attacker could use this flaw to write to a destination outside the gluster volume.

Security update for glusterfs

glusterfs: Unsanitized file names in debug/io-stats translator can allow remote attackers to execute arbitrary code glusterfs: Stack-based buffer overflow in server-rpc-fops.c allows remote attackers to execute arbitrary code glusterfs: Improper deserialization in dict.c:dict_unserialize() can allow attackers to read arbitrary memory glusterfs: Information Exposure in posix_get_file_contents function in posix-helpers.c glusterfs: remote denial of service of gluster volumes via posix_get_file_contents function in posix-helpers.c glusterfs: I/O to arbitrary devices on storage server glusterfs: Device files can be created in arbitrary locations glusterfs: File status information leak and denial of service glusterfs: Improper resolution of symlinks allows for privilege escalation glusterfs: Arbitrary file creation on storage server allows for execution of arbitrary code glusterfs: Files can be renamed outside volume

Affected: Ubuntu:Pro:14.04:LTS: glusterfs, Ubuntu:Pro:16.04:LTS: glusterfs, Ubuntu:Pro:18.04:LTS: glusterfs

A flaw was found in RPC request using gfs3_rename_req in glusterfs server. An authenticated attacker could use this flaw to write to a destination outside the gluster volume.