DSA-2021-201: Dell PowerScale OneFS Security Update for Multiple Vulnerabilities
Yhteenveto: Dell PowerScale OneFS remediation is available for multiple vulnerabilities that could be exploited by malicious users to compromise the affected system.
Tämä artikkeli koskee tuotetta
Tämä artikkeli ei koske tuotetta
Tämä artikkeli ei liity tiettyyn tuotteeseen.
Tässä artikkelissa ei yksilöidä kaikkia tuoteversioita.
Vaikutus
Critical
Tiedot
| Proprietary Code CVEs | Description | CVSS Base Score | CVSS Vector String |
| CVE-2021-21528 | Dell EMC PowerScale OneFS versions 9.1.0, 9.2.0.x, and 9.2.1.x contain an Exposure of Information through Directory Listing vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to gain unauthorized access to the filesystem. | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CVE-2021-36315 | Dell EMC PowerScale Nodes contain a hardware design flaw. This may allow a local unauthenticated user to escalate privileges. This also affects Compliance mode and for Compliance mode clusters, is a critical vulnerability. Dell EMC recommends applying the workaround at your earliest opportunity. | 6.8 | CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Third-party Component | CVE | More information |
| Python | CVE-2019-20907 | https://nvd.nist.gov/vuln/detail/CVE-2019-20907 |
| cURL | Multiple CVEs | https://curl.se/docs/vuln-7.77.0.html |
| Proprietary Code CVEs | Description | CVSS Base Score | CVSS Vector String |
| CVE-2021-21528 | Dell EMC PowerScale OneFS versions 9.1.0, 9.2.0.x, and 9.2.1.x contain an Exposure of Information through Directory Listing vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to gain unauthorized access to the filesystem. | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CVE-2021-36315 | Dell EMC PowerScale Nodes contain a hardware design flaw. This may allow a local unauthenticated user to escalate privileges. This also affects Compliance mode and for Compliance mode clusters, is a critical vulnerability. Dell EMC recommends applying the workaround at your earliest opportunity. | 6.8 | CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Third-party Component | CVE | More information |
| Python | CVE-2019-20907 | https://nvd.nist.gov/vuln/detail/CVE-2019-20907 |
| cURL | Multiple CVEs | https://curl.se/docs/vuln-7.77.0.html |
Tuotteet, joihin asia vaikuttaa, ja tilanteen korjaaminen
| CVEs Addressed | Affected Versions | Updated Versions | Link to Update | |
| CVE-2019-20907 | 8.2.0, 8.2.1, 9.0.0.x, 9.2.0.x, 9.1.1.x | Upgrade your version of OneFS | ||
| 8.2.2, 9.1.0.x , 9.2.1.x | Download and install the latest RUP | |||
| CVE-2021-21528 | 9.2.0.x | Upgrade your version of OneFS | PowerScale OneFS Downloads Area | |
| 9.1.0.x , 9.2.1.x | Download and install the latest RUP | |||
| CVE-2021-36315 | A100, S210, X410, H400, X210, NL410, A200, A2000, H400, H500, H600, H5600, F800, F810,F200, F600, A300, A3000, H700, H7000 |
See Knowledge Article 192465: [Isilon] How to enable/disable USB boot and/or secure the BIOS on Isilon nodes. |
||
| See the PowerScale Security Configuration Guide Section: Disable USB Boot on nodes. |
||||
Note: The above table may not be a comprehensive list of all affected supported versions and may be updated as more information becomes available.
| CVEs Addressed | Affected Versions | Updated Versions | Link to Update | |
| CVE-2019-20907 | 8.2.0, 8.2.1, 9.0.0.x, 9.2.0.x, 9.1.1.x | Upgrade your version of OneFS | ||
| 8.2.2, 9.1.0.x , 9.2.1.x | Download and install the latest RUP | |||
| CVE-2021-21528 | 9.2.0.x | Upgrade your version of OneFS | PowerScale OneFS Downloads Area | |
| 9.1.0.x , 9.2.1.x | Download and install the latest RUP | |||
| CVE-2021-36315 | A100, S210, X410, H400, X210, NL410, A200, A2000, H400, H500, H600, H5600, F800, F810,F200, F600, A300, A3000, H700, H7000 |
See Knowledge Article 192465: [Isilon] How to enable/disable USB boot and/or secure the BIOS on Isilon nodes. |
||
| See the PowerScale Security Configuration Guide Section: Disable USB Boot on nodes. |
||||
Note: The above table may not be a comprehensive list of all affected supported versions and may be updated as more information becomes available.
Kiertotavat ja lievennyskeinot
| Workarounds or Mitigations | |
| CVE-2021-21528 | Verify that a value for redirect flag is set. Check the current gconfig value: # isi_gconfig -q -t http-config redirectIf nothing is returned, this means the value has not been set, and is using defaults. This must be set to true: # isi_gconfig -q -t http-config redirect=trueConfirm the value is now set: # isi_gconfig -q -t http-config redirect |
| In Compliance Mode: Verify that a value for redirect flag is set. Check the current gconfig value: # sudo isi_gconfig -q -t http-config redirectIf nothing is returned, this means the value has not been set, and is using defaults. This must be set to true: # sudo isi_gconfig -q -t http-config redirect=trueConfirm the value is now set: # sudo isi_gconfig -q -t http-config redirect |
|
| CVE-2021-36315 | See the PowerScale Security Configuration Guide |
| Python | None |
| cURL | None |
Versiohistoria
| Revision | Date | Description |
| 1.0 | 2021-10-28 | Initial Release |
| 2.0 | 2021-11-08 | Links and CVEs updated |
Asiaan liittyvät tiedot
Vastuuvapauslauseke
Tuotteet, joihin vaikutus kohdistuu
Isilon A100, Isilon A200, Isilon A2000, Isilon F800, Isilon F810, Isilon H400, Isilon H500, Isilon H600, Isilon NL410, PowerScale OneFS, Isilon S210, Isilon X210, Isilon X410, PowerScale Archive A300, PowerScale Archive A3000, PowerScale F200
, PowerScale F600, PowerScale Hybrid H700, PowerScale Hybrid H7000, Product Security Information
...
Artikkelin ominaisuudet
Artikkelin numero: 000193005
Artikkelin tyyppi: Dell Security Advisory
Viimeksi muutettu: 15 helmik. 2022
Etsi vastauksia kysymyksiisi muilta Dell-käyttäjiltä
Tukipalvelut
Tarkista, kuuluuko laitteesi tukipalveluiden piiriin.