CVE-2018-7168
Updated openafs packages fix security vulnerability
Openafs packages have been updated to 1.9.1 for various bugfixes, and added a fix for security vulnerability:
There exist in the wild AFS3 clients that improperly construct access control lists which are then stored to directories via RXAFS_StoreACL (opcode 134). These clients add negative access control entries (if any) to the normal rights list. As there is no method by which a fileserver can determine that the ACL is improperly constructed, the only method to defend the storage of broken ACLs is to identify clients that are known to properly construct ACLs by introducing a new RXAFS_StoreACL opcode (164) (CVE-2018-7168).
Additionally the CellServDB has been updated to latest version and fixes for suppoorting kernel 5.14 and 5.15 series have been added.
What each source reports
OSVMGASA-2021-0509 No score
Updated openafs packages fix security vulnerability
Openafs packages have been updated to 1.9.1 for various bugfixes, and added a fix for security vulnerability:
There exist in the wild AFS3 clients that improperly construct access control lists which are then stored to directories via RXAFS_StoreACL (opcode 134). These clients add negative access control entries (if any) to the normal rights list. As there is no method by which a fileserver can determine that the ACL is improperly constructed, the only method to defend the storage of broken ACLs is to identify clients that are known to properly construct ACLs by introducing a new RXAFS_StoreACL opcode (164) (CVE-2018-7168).
Additionally the CellServDB has been updated to latest version and fixes for suppoorting kernel 5.14 and 5.15 series have been added.
- Record
MGASA-2021-0509- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
openafsMageia:8 |
before 1.9.1-1.mga8 | 1.9.1-1.mga8 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-7168 is a vulnerability with no CVSS score yet in openafs, published November 11, 2021. No source lists public exploit code. Fixed in openafs 1.9.1-1.mga8.