CVE-2018-10911CWE-190CWE-200CWE-502

A flaw was found in the way dic_unserialize function of glusterfs does not handle negative key length values

Medium · published September 4, 2018

CVSS v3.0
6.5
EPSS
3%
Percentile
86.7
In the wild
Unconfirmed
What it is

A flaw was found in the way dic_unserialize function of glusterfs does not handle negative key length values. An attacker could use this flaw to read memory from other locations into the stored dict value.

The record
Technical detail
CVSS v3.0
6.5 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.02871 · 86.7th percentile
Weaknesses
CWE-190 · Integer Overflow or Wraparound; CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-502 · Deserialization of Untrusted Data
Published
2018-09-04T14:00Z
EPSS history
Timeline
  • 04 SEP 14:00Z
    A flaw was found in the way dic_unserialize function of glusterfs does not handle negative key length values
    cvelistv5