DSA-2019-050: Dell EMC Cloud Tiering Appliance Family Security Update for Multiple Vulnerabilities in Embedded Components

The components have been updated to address the following vulnerabilities:     

• OpenSSL

CVE-2016-8610    CVE-2018-0734    CVE-2018-0737    CVE-2018-5407

• rpm

CVE-2017-7500    CVE-2017-7501

• Mozilla Firefox, Mozilla-nspr / Mozilla-nss

CVE-2018-0495      CVE-2018-12384    CVE-2018-12404    CVE-2018-12405
CVE-2018-17466    CVE-2018-18492    CVE-2018-18493    CVE-2018-18494
CVE-2018-18498

• postgresql94

CVE-2018-10915

• OpenSSH

CVE-2018-15473    CVE-2018-15919

• ghostscript

CVE-2018-17183    CVE-2018-17961    CVE-2018-18073    CVE-2018-18284
CVE-2018-19409    CVE-2018-19475    CVE-2018-19476    CVE-2018-19477

• net-snmp  

CVE-2018-18065

For more information about any of the Common Vulnerabilities and Exposures (CVEs) mentioned here, consult the National Vulnerability Database (NVD) at http://nvd.nist.gov/home.cfm.

To search for a particular CVE, use the database s search utility at http://web.nvd.nist.gov/view/vuln/search.

Affected products:      
Dell EMC Cloud Tiering Appliance (CTA) versions prior to 12.1.0.65
Dell EMC Cloud Tiering Appliance High Availability (CTA-HA) versions prior to 12.1.0.65
Dell EMC Cloud Tiering Appliance Virtual Edition (CTA/VE) versions prior to 12.1.0.65
Dell EMC Cloud Tiering Appliance Virtual Edition High Availability (CTA/VE-HA) versions prior to 12.1.0.65


Remediation:      
Dell EMC Cloud Tiering Appliance 12.1.0.65 addresses these vulnerabilities. Dell EMC recommends all customers upgrade at the earliest opportunity.

Customers running versions 11.0, 12.0, and 12.0 SP1 can perform an in-place upgrade using the following UPG package files:     

• Dell EMC Cloud Tiering Appliance (CTA and CTA/VE) 12.1.0.65 UPG Package file

• Dell EMC Cloud Tiering Appliance (CTA HA and CTA/VE-HA) 12.1.0.65 High Availability UPG Package file

Customers running version 10.0.SP3.1 will have to perform a backup and restore to a clean install of CTA or CTA/VE. The following CTA and CTA-HA installation discs and CTA-VE and CTA/VE-HA OVA files can be used to perform a clean install of CTA, CTA-HA, CTA/VE, and CTA/VE-HA systems.

• Cloud Tiering Appliance 12.1.0.65 Installation disc

• Cloud Tiering Appliance 12.1.0.65 High Availability Installation disc

• Cloud Tiering Appliance Virtual Edition 12.1.0.65 OVA

• Cloud Tiering Appliance Virtual Edition 12.1.0.65 High Availability OVA

The upgrade package files for Dell EMC CTA, CTA/VE, CTA-HA, and CTA/VE-HA systems and the ISO installation discs for Dell EMC CTA and CTA-HA can be found under the FULL RELEASE product downloads section at the following link:  https://support.emc.com/downloads/6298_Cloud-Tiering-Appliance

The OVA files for Dell EMC CTA/VE and CTA/VE-HA can be found under the FULL RELEASE product downloads section at the following link:  https://support.emc.com/downloads/16781_Cloud-Tiering-Appliance-VE