A flaw was found in the way dic_unserialize function of glusterfs does not handle negative key length values.

published 2018-09-04 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-2967

cvss: 6.5; version 3.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 2.9%; EPSS 2.9% chance of exploitation in 30 days, percentile 86%
public exploits: 0; none known

A flaw was found in the way dic_unserialize function of glusterfs does not handle negative key length values. An attacker could use this flaw to read memory from other locations into the stored dict value.

Patch / fix

fixed in 1 distros 4 links 1

gluster glusterfs 3.12.14, 4.1.8

debian ubuntu red hat opensuse

glusterfs Debian 14, Debian 13, Debian 12 4.1.4-1

debian advisories DEBIAN-CVE-2018-10911

glusterfs Ubuntu Pro 14.04 LTS 3.4.2-1ubuntu1+esm1
glusterfs Ubuntu Pro 16.04 LTS 3.7.6-1ubuntu1+esm1
glusterfs Ubuntu Pro 18.04 LTS 3.13.2-1ubuntu1+esm1

ubuntu advisories UBUNTU-CVE-2018-10911

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

imgbased RHEL 7 1.0.29-1.el7ev
python-imgbased RHEL 7 1.0.29-1.el7ev
redhat-virtualization-host RHEL 7 4.2-20181026.0.el7_6
redhat-release-virtualization-host RHEL 7 4.2-7.3.el7
redhat-virtualization-host-image-update RHEL 7 4.2-20181026.0.el7_6
redhat-virtualization-host-image-update-placeholder RHEL 7 4.2-7.3.el7
glusterfs storage 3, RHEL 7 3.12.2-18.el7
glusterfs-api storage 3, RHEL 7 3.12.2-18.el7

red hat advisories RHSA-2018:3470 RHSA-2018:3242 RHSA-2018:2892 RHSA-2018:2607 RHSA-2018:2608

glusterfs openSUSE Leap 15.1 3.12.15-lp151.3.3.1

opensuse advisories openSUSE-SU-2020:0079-1

review.gluster.org/#/c/glusterfs/+/21067/ advisory

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-10911 updated 2026-11-05 cvss 6.5

glusterfs: Improper deserialization in dict.c:dict_unserialize() can allow attackers to read arbitrary memory

Red Hat Enterprise Linux Client (v. 7) glusterfs 3.12.2-18.el7, glusterfs-api 3.12.2-18.el7, glusterfs-cli 3.12.2-18.el7, glusterfs-fuse 3.12.2-18.el7, glusterfs-libs 3.12.2-18.el7, glusterfs-client-xlators 3.12.2-18.el7 Red Hat Enterprise Linux Client Optional (v. 7) glusterfs-rdma 3.12.2-18.el7, python2-gluster 3.12.2-18.el7 Red Hat Enterprise Linux ComputeNode (v. 7) glusterfs 3.12.2-18.el7, glusterfs-api 3.12.2-18.el7, glusterfs-fuse 3.12.2-18.el7, glusterfs-libs 3.12.2-18.el7, glusterfs-rdma 3.12.2-18.el7, glusterfs-client-xlators 3.12.2-18.el7 Red Hat Enterprise Linux ComputeNode Optional (v. 7) glusterfs-cli 3.12.2-18.el7, python2-gluster 3.12.2-18.el7
fixed: vendor fix RHSA-2018:3242
Red Hat Enterprise Linux Desktop (v. 6) glusterfs 3.12.2-18.el6, glusterfs-api 3.12.2-18.el6, glusterfs-fuse 3.12.2-18.el6, glusterfs-libs 3.12.2-18.el6, glusterfs-client-xlators 3.12.2-18.el6 Red Hat Enterprise Linux Desktop Optional (v. 6) glusterfs-cli 3.12.2-18.el6, glusterfs-rdma 3.12.2-18.el6
fixed: vendor fix RHSA-2018:2892
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) glusterfs 3.12.2-18.el7, glusterfs-libs 3.12.2-18.el7, glusterfs-rdma 3.12.2-18.el7 Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) glusterfs-api 3.12.2-18.el7, glusterfs-cli 3.12.2-18.el7, glusterfs-fuse 3.12.2-18.el7, python2-gluster 3.12.2-18.el7, glusterfs-client-xlators 3.12.2-18.el7
fixed: vendor fix RHSA-2018:3242
Red Hat Enterprise Linux HPC Node (v. 6) glusterfs 3.12.2-18.el6, glusterfs-api 3.12.2-18.el6, glusterfs-fuse 3.12.2-18.el6, glusterfs-libs 3.12.2-18.el6, glusterfs-rdma 3.12.2-18.el6, glusterfs-client-xlators 3.12.2-18.el6 Red Hat Enterprise Linux HPC Node Optional (v. 6) glusterfs-cli 3.12.2-18.el6 Red Hat Enterprise Linux Server (v. 6) glusterfs 3.12.2-18.el6, glusterfs-api 3.12.2-18.el6, glusterfs-fuse 3.12.2-18.el6, glusterfs-libs 3.12.2-18.el6, glusterfs-rdma 3.12.2-18.el6, glusterfs-client-xlators 3.12.2-18.el6
fixed: vendor fix RHSA-2018:2892
Red Hat Enterprise Linux Server (v. 7) glusterfs 3.12.2-18.el7, glusterfs-api 3.12.2-18.el7, glusterfs-cli 3.12.2-18.el7, glusterfs-fuse 3.12.2-18.el7, glusterfs-libs 3.12.2-18.el7, glusterfs-rdma 3.12.2-18.el7, +1 more
fixed: vendor fix RHSA-2018:3242
Red Hat Enterprise Linux Server Optional (v. 6) glusterfs-cli 3.12.2-18.el6
fixed: vendor fix RHSA-2018:2892
Red Hat Enterprise Linux Server Optional (v. 7) glusterfs-api 3.12.2-18.el7, glusterfs-cli 3.12.2-18.el7, glusterfs-fuse 3.12.2-18.el7, python2-gluster 3.12.2-18.el7, glusterfs-client-xlators 3.12.2-18.el7
fixed: vendor fix RHSA-2018:3242
Red Hat Enterprise Linux Workstation (v. 6) glusterfs 3.12.2-18.el6, glusterfs-api 3.12.2-18.el6, glusterfs-fuse 3.12.2-18.el6, glusterfs-libs 3.12.2-18.el6, glusterfs-rdma 3.12.2-18.el6, glusterfs-client-xlators 3.12.2-18.el6
fixed: vendor fix RHSA-2018:2892

show 11 more

Red Hat Enterprise Linux Workstation (v. 7) glusterfs 3.12.2-18.el7, glusterfs-api 3.12.2-18.el7, glusterfs-cli 3.12.2-18.el7, glusterfs-fuse 3.12.2-18.el7, glusterfs-libs 3.12.2-18.el7, glusterfs-rdma 3.12.2-18.el7, +1 more
fixed: vendor fix RHSA-2018:3242
Red Hat Enterprise Linux Workstation Optional (v. 6) glusterfs-cli 3.12.2-18.el6
fixed: vendor fix RHSA-2018:2892
Red Hat Enterprise Linux Workstation Optional (v. 7) python2-gluster 3.12.2-18.el7
fixed: vendor fix RHSA-2018:3242
Red Hat Gluster Storage Server 3.4 on RHEL-6 glusterfs 3.12.2-18.el6rhs, glusterfs-api 3.12.2-18.el6rhs, glusterfs-cli 3.12.2-18.el6rhs, glusterfs-fuse 3.12.2-18.el6rhs, glusterfs-libs 3.12.2-18.el6rhs, glusterfs-rdma 3.12.2-18.el6rhs, +8 more
fixed: vendor fix RHSA-2018:2608
Red Hat Gluster Storage Server 3.4 on RHEL-7 glusterfs 3.12.2-18.el7rhgs, glusterfs-api 3.12.2-18.el7rhgs, glusterfs-cli 3.12.2-18.el7rhgs, glusterfs-fuse 3.12.2-18.el7rhgs, glusterfs-libs 3.12.2-18.el7rhgs, glusterfs-rdma 3.12.2-18.el7rhgs, +9 more
fixed: vendor fix RHSA-2018:2607
Red Hat Storage Native Client for Red Hat Enterprise Linux 6 glusterfs 3.12.2-18.el6, glusterfs-api 3.12.2-18.el6, glusterfs-cli 3.12.2-18.el6, glusterfs-fuse 3.12.2-18.el6, glusterfs-libs 3.12.2-18.el6, glusterfs-rdma 3.12.2-18.el6, +2 more
fixed: vendor fix RHSA-2018:2608
Red Hat Storage Native Client for Red Hat Enterprise Linux 7 glusterfs 3.12.2-18.el7, glusterfs-api 3.12.2-18.el7, glusterfs-cli 3.12.2-18.el7, glusterfs-fuse 3.12.2-18.el7, glusterfs-libs 3.12.2-18.el7, glusterfs-rdma 3.12.2-18.el7, +2 more
fixed: vendor fix RHSA-2018:2607
Red Hat Virtualization 4 Hypervisor for RHEL 7 redhat-virtualization-host 4.2-20181026.0.el7_6, redhat-virtualization-host-image-update 4.2-20181026.0.el7_6
fixed: vendor fix RHSA-2018:3470
Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts glusterfs 3.12.2-18.el7, glusterfs-api 3.12.2-18.el7, glusterfs-cli 3.12.2-18.el7, glusterfs-fuse 3.12.2-18.el7, glusterfs-libs 3.12.2-18.el7, glusterfs-rdma 3.12.2-18.el7, +1 more
fixed: vendor fix RHSA-2018:2607
Red Hat RHEL 7-based RHEV-H for RHEV 4 (build requirements) imgbased 1.0.29-1.el7ev, python-imgbased 1.0.29-1.el7ev, redhat-release-virtualization-host 4.2-7.3.el7, redhat-virtualization-host-image-update-placeholder 4.2-7.3.el7
fixed: vendor fix RHSA-2018:3470
Red Hat Enterprise Linux 8 glusterfs, glusterfs-api, glusterfs-cli, glusterfs-fuse, glusterfs-libs, glusterfs-rdma, +2 more
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.87% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.0	6.5	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected products

Red Hat glusterfs:

Classification

Weakness

CWE-502 Deserialization of Untrusted Data
CWE-190 Integer Overflow or Wraparound
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

review.gluster.org /#/c/glusterfs/+/21067/
patch, vendor-advisory
access.redhat.com /errata/RHSA-2018:2607
vendor-advisory, third-party-advisory
access.redhat.com /errata/RHSA-2018:2608
vendor-advisory, third-party-advisory
access.redhat.com /errata/RHSA-2018:3470
vendor-advisory, third-party-advisory
access.redhat.com /errata/RHSA-2018:2892
vendor-advisory, third-party-advisory
access.redhat.com /errata/RHSA-2018:3242
vendor-advisory, third-party-advisory
security.gentoo.org /glsa/201904-06
vendor-advisory, third-party-advisory
lists.opensuse.org /opensuse-security-announce/2020-01/msg00035.html
vendor-advisory, mailing-list, third-party-advisory
bugzilla.redhat.com /show_bug.cgi?id=CVE-2018-10911
issue-tracking, third-party-advisory
lists.debian.org /debian-lts-announce/2018/09/msg00021.html
mailing-list, third-party-advisory
lists.debian.org /debian-lts-announce/2021/11/msg00000.html
mailing-list, third-party-advisory

Sources

CVE List CVE-2018-10911
NVD CVE-2018-10911

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary