Every CVE Search/ Get API key

CVE-2018-1112

glusterfs server before versions 3.10.12, 4.0.2 is vulnerable when using 'auth.allow' option...

8.0 HighFix available

glusterfs server before versions 3.10.12, 4.0.2 is vulnerable when using 'auth.allow' option which allows any unauthenticated gluster client to connect from any network to mount gluster storage volumes. NOTE: this vulnerability exists because of a CVE-2018-1088 regression.

Attack profile

How easy it is to exploit

Attack vector
Adjacent network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

2.35%Down 3.9 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 8.0

glusterfs server before versions 3.10.12, 4.0.2 is vulnerable when using 'auth.allow' option which allows any unauthenticated gluster client to connect from any network to mount gluster storage volumes. NOTE: this vulnerability exists because of a CVE-2018-1088 regression.

Record
CVE-2018-1112
CVSS 3.0
8.0 HighCVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-287
Updated
2026-11-02
EUVDEUVD-2018-11757 8.0

glusterfs server before versions 3.10.12, 4.0.2 is vulnerable when using 'auth.allow' option which allows any unauthenticated gluster client to connect from any network to mount gluster storage volumes. NOTE: this vulnerability exists because of a CVE-2018-1088 regression.

Record
EUVD-2018-11757
CVSS 3.0
8.0 HighCVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-g75c-rwx3-m2xp 8.8

glusterfs server before versions 3.10.12, 4.0.2 is vulnerable when using 'auth.allow' option...

glusterfs server before versions 3.10.12, 4.0.2 is vulnerable when using 'auth.allow' option which allows any unauthenticated gluster client to connect from any network to mount gluster storage volumes. NOTE: this vulnerability exists because of a CVE-2018-1088 regression.

Record
GHSA-g75c-rwx3-m2xp
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
NVD 8.0

glusterfs server before versions 3.10.12, 4.0.2 is vulnerable when using 'auth.allow' option which allows any unauthenticated gluster client to connect from any network to mount gluster storage volumes. NOTE: this vulnerability exists because of a CVE-2018-1088 regression.

Record
CVE-2018-1112
CVSS 3.0
8.0 HighCVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-287
Updated
2026-11-02
OSV 8.8

glusterfs server before versions 3.10.12, 4.0.2 is vulnerable when using 'auth.allow' option which allows any unauthenticated gluster client to connect from any network to mount gluster storage volumes. NOTE: this vulnerability exists because of a CVE-2018-1088 regression.

Record
CVE-2018-1112
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2018:1268 8.0

Red Hat Security Advisory: glusterfs security update

Record
RHSA-2018:1268
CVSS 3.0
8.0 HighCVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2018:1269 8.0

Red Hat Security Advisory: glusterfs security update

Record
RHSA-2018:1269
CVSS 3.0
8.0 HighCVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2018-1112 8.8

glusterfs server before versions 3.10.12, 4.0.2 is vulnerable when using 'auth.allow' option which allows any unauthenticated gluster client to connect from any network to mount gluster storage volumes. NOTE: this vulnerability exists because of a CVE-2018-1088 regression.

Record
UBUNTU-CVE-2018-1112
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0
8.0 HighCVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2020:0079-1 No score

Security update for glusterfs

This update for glusterfs fixes the following issues:

glusterfs was update to release 3.12.15:

  • Fixed a number of bugs and security issues:
  • CVE-2018-1088, CVE-2018-1112 [boo#1090084], CVE-2018-10904 [boo#1107018], CVE-2018-10907 [boo#1107019], CVE-2018-10911 [boo#1107020], CVE-2018-10913 [boo#1107021], CVE-2018-10914 [boo#1107022], CVE-2018-10923 [boo#1107023], CVE-2018-10924 [boo#1107024], CVE-2018-10926 [boo#1107025], CVE-2018-10927 [boo#1107026], CVE-2018-10928 [boo#1107027], CVE-2018-10928 [boo#1107027], CVE-2018-10929 [boo#1107028], CVE-2018-10930 [boo#1107029], boo#1105776 .
Record
openSUSE-SU-2020:0079-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
glusterfs
Red Hat:storage:3.3:server:el6
 before 0:3.8.4-54.9.el6rhs
0:3.8.4-54.9.el6rhs
glusterfs-api
Red Hat:storage:3.3:server:el6
 before 0:3.8.4-54.9.el6rhs
0:3.8.4-54.9.el6rhs
glusterfs-api-devel
Red Hat:storage:3.3:server:el6
 before 0:3.8.4-54.9.el6rhs
0:3.8.4-54.9.el6rhs
glusterfs-cli
Red Hat:storage:3.3:server:el6
 before 0:3.8.4-54.9.el6rhs
0:3.8.4-54.9.el6rhs
glusterfs-client-xlators
Red Hat:storage:3.3:server:el6
 before 0:3.8.4-54.9.el6rhs
0:3.8.4-54.9.el6rhs
glusterfs-debuginfo
Red Hat:storage:3.3:server:el6
 before 0:3.8.4-54.9.el6rhs
0:3.8.4-54.9.el6rhs
glusterfs-devel
Red Hat:storage:3.3:server:el6
 before 0:3.8.4-54.9.el6rhs
0:3.8.4-54.9.el6rhs
glusterfs-events
Red Hat:storage:3.3:server:el6
 before 0:3.8.4-54.9.el6rhs
0:3.8.4-54.9.el6rhs
glusterfs-fuse
Red Hat:storage:3.3:server:el6
 before 0:3.8.4-54.9.el6rhs
0:3.8.4-54.9.el6rhs
glusterfs-ganesha
Red Hat:storage:3.3:server:el6
 before 0:3.8.4-54.9.el6rhs
0:3.8.4-54.9.el6rhs
Show 55 moreShow less
Affected packages
PackageAffectedFixed
glusterfs-geo-replication
Red Hat:storage:3.3:server:el6
 before 0:3.8.4-54.9.el6rhs
0:3.8.4-54.9.el6rhs
glusterfs-libs
Red Hat:storage:3.3:server:el6
 before 0:3.8.4-54.9.el6rhs
0:3.8.4-54.9.el6rhs
glusterfs-rdma
Red Hat:storage:3.3:server:el6
 before 0:3.8.4-54.9.el6rhs
0:3.8.4-54.9.el6rhs
glusterfs-server
Red Hat:storage:3.3:server:el6
 before 0:3.8.4-54.9.el6rhs
0:3.8.4-54.9.el6rhs
python-gluster
Red Hat:storage:3.3:server:el6
 before 0:3.8.4-54.9.el6rhs
0:3.8.4-54.9.el6rhs
glusterfs
Red Hat:storage:3:client:el6
 before 0:3.8.4-54.9.el6
0:3.8.4-54.9.el6
glusterfs-api
Red Hat:storage:3:client:el6
 before 0:3.8.4-54.9.el6
0:3.8.4-54.9.el6
glusterfs-api-devel
Red Hat:storage:3:client:el6
 before 0:3.8.4-54.9.el6
0:3.8.4-54.9.el6
glusterfs-cli
Red Hat:storage:3:client:el6
 before 0:3.8.4-54.9.el6
0:3.8.4-54.9.el6
glusterfs-client-xlators
Red Hat:storage:3:client:el6
 before 0:3.8.4-54.9.el6
0:3.8.4-54.9.el6
glusterfs-debuginfo
Red Hat:storage:3:client:el6
 before 0:3.8.4-54.9.el6
0:3.8.4-54.9.el6
glusterfs-devel
Red Hat:storage:3:client:el6
 before 0:3.8.4-54.9.el6
0:3.8.4-54.9.el6
glusterfs-fuse
Red Hat:storage:3:client:el6
 before 0:3.8.4-54.9.el6
0:3.8.4-54.9.el6
glusterfs-libs
Red Hat:storage:3:client:el6
 before 0:3.8.4-54.9.el6
0:3.8.4-54.9.el6
glusterfs-rdma
Red Hat:storage:3:client:el6
 before 0:3.8.4-54.9.el6
0:3.8.4-54.9.el6
python-gluster
Red Hat:storage:3:client:el6
 before 0:3.8.4-54.9.el6
0:3.8.4-54.9.el6
glusterfs
Red Hat:storage:3.3:server:el7
 before 0:3.8.4-54.8.el7rhgs
0:3.8.4-54.8.el7rhgs
glusterfs-api
Red Hat:storage:3.3:server:el7
 before 0:3.8.4-54.8.el7rhgs
0:3.8.4-54.8.el7rhgs
glusterfs-api-devel
Red Hat:storage:3.3:server:el7
 before 0:3.8.4-54.8.el7rhgs
0:3.8.4-54.8.el7rhgs
glusterfs-cli
Red Hat:storage:3.3:server:el7
 before 0:3.8.4-54.8.el7rhgs
0:3.8.4-54.8.el7rhgs
glusterfs-client-xlators
Red Hat:storage:3.3:server:el7
 before 0:3.8.4-54.8.el7rhgs
0:3.8.4-54.8.el7rhgs
glusterfs-debuginfo
Red Hat:storage:3.3:server:el7
 before 0:3.8.4-54.8.el7rhgs
0:3.8.4-54.8.el7rhgs
glusterfs-devel
Red Hat:storage:3.3:server:el7
 before 0:3.8.4-54.8.el7rhgs
0:3.8.4-54.8.el7rhgs
glusterfs-events
Red Hat:storage:3.3:server:el7
 before 0:3.8.4-54.8.el7rhgs
0:3.8.4-54.8.el7rhgs
glusterfs-fuse
Red Hat:storage:3.3:server:el7
 before 0:3.8.4-54.8.el7rhgs
0:3.8.4-54.8.el7rhgs
glusterfs-ganesha
Red Hat:storage:3.3:server:el7
 before 0:3.8.4-54.8.el7rhgs
0:3.8.4-54.8.el7rhgs
glusterfs-geo-replication
Red Hat:storage:3.3:server:el7
 before 0:3.8.4-54.8.el7rhgs
0:3.8.4-54.8.el7rhgs
glusterfs-libs
Red Hat:storage:3.3:server:el7
 before 0:3.8.4-54.8.el7rhgs
0:3.8.4-54.8.el7rhgs
glusterfs-rdma
Red Hat:storage:3.3:server:el7
 before 0:3.8.4-54.8.el7rhgs
0:3.8.4-54.8.el7rhgs
glusterfs-resource-agents
Red Hat:storage:3.3:server:el7
 before 0:3.8.4-54.8.el7rhgs
0:3.8.4-54.8.el7rhgs
glusterfs-server
Red Hat:storage:3.3:server:el7
 before 0:3.8.4-54.8.el7rhgs
0:3.8.4-54.8.el7rhgs
python-gluster
Red Hat:storage:3.3:server:el7
 before 0:3.8.4-54.8.el7rhgs
0:3.8.4-54.8.el7rhgs
glusterfs
Red Hat:enterprise_linux:7::hypervisor
 before 0:3.8.4-54.8.el7
0:3.8.4-54.8.el7
glusterfs-api
Red Hat:enterprise_linux:7::hypervisor
 before 0:3.8.4-54.8.el7
0:3.8.4-54.8.el7
glusterfs-api-devel
Red Hat:enterprise_linux:7::hypervisor
 before 0:3.8.4-54.8.el7
0:3.8.4-54.8.el7
glusterfs-cli
Red Hat:enterprise_linux:7::hypervisor
 before 0:3.8.4-54.8.el7
0:3.8.4-54.8.el7
glusterfs-client-xlators
Red Hat:enterprise_linux:7::hypervisor
 before 0:3.8.4-54.8.el7
0:3.8.4-54.8.el7
glusterfs-debuginfo
Red Hat:enterprise_linux:7::hypervisor
 before 0:3.8.4-54.8.el7
0:3.8.4-54.8.el7
glusterfs-devel
Red Hat:enterprise_linux:7::hypervisor
 before 0:3.8.4-54.8.el7
0:3.8.4-54.8.el7
glusterfs-fuse
Red Hat:enterprise_linux:7::hypervisor
 before 0:3.8.4-54.8.el7
0:3.8.4-54.8.el7
glusterfs-libs
Red Hat:enterprise_linux:7::hypervisor
 before 0:3.8.4-54.8.el7
0:3.8.4-54.8.el7
glusterfs-rdma
Red Hat:enterprise_linux:7::hypervisor
 before 0:3.8.4-54.8.el7
0:3.8.4-54.8.el7
python-gluster
Red Hat:enterprise_linux:7::hypervisor
 before 0:3.8.4-54.8.el7
0:3.8.4-54.8.el7
glusterfs
Red Hat:storage:3:client:el7
 before 0:3.8.4-54.8.el7
0:3.8.4-54.8.el7
glusterfs-api
Red Hat:storage:3:client:el7
 before 0:3.8.4-54.8.el7
0:3.8.4-54.8.el7
glusterfs-api-devel
Red Hat:storage:3:client:el7
 before 0:3.8.4-54.8.el7
0:3.8.4-54.8.el7
glusterfs-cli
Red Hat:storage:3:client:el7
 before 0:3.8.4-54.8.el7
0:3.8.4-54.8.el7
glusterfs-client-xlators
Red Hat:storage:3:client:el7
 before 0:3.8.4-54.8.el7
0:3.8.4-54.8.el7
glusterfs-debuginfo
Red Hat:storage:3:client:el7
 before 0:3.8.4-54.8.el7
0:3.8.4-54.8.el7
glusterfs-devel
Red Hat:storage:3:client:el7
 before 0:3.8.4-54.8.el7
0:3.8.4-54.8.el7
glusterfs-fuse
Red Hat:storage:3:client:el7
 before 0:3.8.4-54.8.el7
0:3.8.4-54.8.el7
glusterfs-libs
Red Hat:storage:3:client:el7
 before 0:3.8.4-54.8.el7
0:3.8.4-54.8.el7
glusterfs-rdma
Red Hat:storage:3:client:el7
 before 0:3.8.4-54.8.el7
0:3.8.4-54.8.el7
python-gluster
Red Hat:storage:3:client:el7
 before 0:3.8.4-54.8.el7
0:3.8.4-54.8.el7
glusterfs
openSUSE:Leap 15.1
From an advisory covering 14 CVEs
 before 3.12.15-lp151.3.3.1
3.12.15-lp151.3.3.1

History

History
RecordedChangedSources
affected, facts
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-1112 is a high vulnerability (CVSS 8.0) in Gluster Glusterfs, published April 25, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.35%, the 83rd percentile. Fixed in glusterfs 0:3.8.4-54.9.el6rhs.

References

Show 38 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open