DSA-2025-097: Security Update for Dell ObjectScale 4.0 Multiple Vulnerabilities

Summary: Dell ObjectScale remediation is available for multiple security vulnerabilities that may be exploited by malicious users to compromise the affected system.

This article applies to This article does not apply to This article is not tied to any specific product. Not all product versions are identified in this article.
Check out other resources

Impact

Critical

Additional Details

As of release 4.x the ECS product name has been rebranded as ObjectScale (OBS). This Security Advisory communicates vulnerabilities affecting the 3.8.1.4 release and its prior versions. Those are remediated in the series now referred to as ObjectScale (OBS).

Details

Third-party Component

CVEs

More Information

Apache Commons Configuration

CVE-2024-29133, CVE-2024-29131

https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies.

Bouncy Castle

CVE-2023-33202, CVE-2024-34447, CVE-2024-30171, CVE-2024-30172, CVE-2024-29857, CVE-2023-33201

https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies.

crypto/tls

CVE-2023-45287

https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies.

Docker

CVE-2020-8694, CVE-2020-8695, CVE-2024-24557

https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies.

eclipse jetty

CVE-2024-22201, CVE-2023-44487, CVE-2021-28169, CVE-2021-34428, CVE-2021-34429, CVE-2022-2047, CVE-2022-2048, CVE-2023-26048, CVE-2023-26049, CVE-2023-36478, CVE-2023-36479, CVE-2023-40167, CVE-2023-41900

https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies.

Expat

CVE-2024-28757, CVE-2022-40674, CVE-2022-43680, CVE-2023-52425

https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies.

github.com/crewjam/saml

CVE-2022-41912, CVE-2023-28119, CVE-2023-45683

https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies.

go.uuid

CVE-2021-3538

https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies.

Golang

CVE-2022-23806, CVE-2022-41716, CVE-2021-3115, CVE-2020-28367, CVE-2020-28366

https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies.

golang.org/x/net

CVE-2023-44487

https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies.

Html

CVE-2023-3978

https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies.

Goxmldsig

CVE-2020-7711

https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies.

go-yaml

CVE-2022-28948

https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies.

h2database

CVE-2021-23463, CVE-2021-42392, CVE-2022-23221, CVE-2022-45868

https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies.

Idna

CVE-2024-3651

https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies.

jackson-databind

CVE-2020-36518, CVE-2022-42003, CVE-2022-42004, CVE-2021-46877, CVE-2023-35116

https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies.

Jersey

CVE-2021-28168

https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies.

jose.v2

CVE-2024-28180

https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies.

libseccomp2

CVE-2019-9893

https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies.

logback receiver

CVE-2023-6378

https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies.

math/big

CVE-2020-28362

https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies.

net/http2

CVE-2023-45288, CVE-2023-39325, CVE-2022-27664, CVE-2022-41717, CVE-2022-41723

https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies.

Netty Project

CVE-2024-29025, CVE-2022-24823, CVE-2022-41881, CVE-2023-34462

https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies.

Nginx

CVE-2023-44487

https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies.

Openssh

CVE-2023-48795

https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies.

Openssl

CVE-2024-0727, CVE-2020-36242, CVE-2023-49083

https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies.

PostgreSQL JDBC Driver (pgjdbc)

CVE-2022-31197, CVE-2022-41946, CVE-2024-1597

https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies.

Protobuf

CVE-2024-24786

https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies.

Pyopenssl

CVE-2018-1000808, CVE-2018-1000807

https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies.

Pytest

CVE-2020-29651

https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies.

python/requests

CVE-2018-18074, CVE-2024-35195

https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies.

python311-base

CVE-2024-4032

https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies.

python3-urllib3

CVE-2023-46218, CVE-2024-37891

https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies.

Setuptools

CVE-2022-40897

https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies.

snappy-java

CVE-2023-34453, CVE-2023-34454, CVE-2023-34455, CVE-2023-43642

https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies.

spring-expression

CVE-2024-38808

https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies.

Zookeeper

CVE-2024-23944, CVE-2023-44981

https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies.

 

Proprietary Code CVEs

Description

CVSS Base Score

CVSS Vector String

CVE-2025-26477

Dell ECS version 3.8.1.4 and prior contain an Improper Input Validation vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution.

4.3

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NThis hyperlink is taking you to a website outside of Dell Technologies.

CVE-2025-26478

Dell ECS version 3.8.1.4 and prior contain an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure.

3.1

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:NThis hyperlink is taking you to a website outside of Dell Technologies.

 

Proprietary Code CVEs

Description

CVSS Base Score

CVSS Vector String

CVE-2025-26477

Dell ECS version 3.8.1.4 and prior contain an Improper Input Validation vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution.

4.3

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NThis hyperlink is taking you to a website outside of Dell Technologies.

CVE-2025-26478

Dell ECS version 3.8.1.4 and prior contain an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure.

3.1

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:NThis hyperlink is taking you to a website outside of Dell Technologies.

 

Dell Technologies recommends all customers consider both the CVSS base score and any relevant temporal and environmental scores that may impact the potential severity associated with a particular security vulnerability.

Affected Products & Remediation

Product

Affected Versions

Remediated Version

Link

Dell ObjectScale

Versions prior to 4.0

Version 4.0 or later

Contact Support for Upgrade

 

Product

Affected Versions

Remediated Version

Link

Dell ObjectScale

Versions prior to 4.0

Version 4.0 or later

Contact Support for Upgrade

 

Dell recommends all customers have their ObjectScale systems upgraded at the earliest opportunity by opening an “Operating Environment Upgrade” Service Request. Customers on ECS 3.8.1.x and ECS 3.8.0.x can upgrade directly to OBS 4.0. Customers on versions prior to ECS 3.8.x need to upgrade to ECS 3.8.x first before upgrading to OBS 4.0.

Note: Please visit the Security Update Release Schedule for Supported Versions of ObjectScale (formerly ECS) for more information.

Revision History

Revision

Date

Description

1.0

2024-03-26

Initial Release

2.0

2024-04-16

Revised Wording

 

Related Information

Dell Security Advisories and Notices
Dell Vulnerability Response Policy
CVSS Scoring Guide

Legal Disclaimer

Affected Products

ECS Appliance Hardware Gen3 EX5000, ECS Appliance Hardware Gen3 EX300, ECS Appliance Hardware Gen3 EX3000, ECS Appliance Hardware Gen2 U-Series, ECS Appliance Hardware Gen3 EX500, ECS Appliance Hardware Gen3 EXF900, ECS Appliance Hardware Series
Article Properties
Article Number: 000300068
Article Type: Dell Security Advisory
Last Modified: 16 Apr 2025
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.