DSA-2025-436: Security Update for Dell PowerFlex Software Multiple Third-Party Component Vulnerabilities
Résumé: Dell PowerFlex Software remediation is available for multiple security vulnerabilities that could be exploited by malicious users to compromise the affected system.
Cet article concerne
Cet article ne concerne pas
Cet article n’est associé à aucun produit spécifique.
Toutes les versions du produit ne sont pas identifiées dans cet article.
Impact
Critical
Détails
| Third-party Component | CVEs | More Information |
| Sudo | CVE-2025-32463 | http://nvd.nist.gov/ |
| Numpy | CVE-2021-41495 | http://nvd.nist.gov/ |
| OpenJDK | CVE-2025-21502 | http://nvd.nist.gov/ |
| OpenSSH | CVE-2023-48795 | http://nvd.nist.gov/ |
| Go | CVE-2024-24790 | http://nvd.nist.gov/ |
| PostgreSQL | CVE-2024-0985, CVE-2023-5869 | http://nvd.nist.gov/ |
| Redis | CVE-2025-49844, CVE-2025-46817, CVE-2025-46818, CVE-2025-46819 | http://nvd.nist.gov/ |
| bundler | CVE-2020-36327 | http://nvd.nist.gov/ |
| cryptography | CVE-2023-50782 | http://nvd.nist.gov/ |
| Docker | CVE-2024-41110 | http://nvd.nist.gov/ |
| GoFiber | CVE-2024-38513 | http://nvd.nist.gov/ |
| GoGo Protobuf | CVE-2021-3121 | http://nvd.nist.gov/ |
| pgproto3, pgx | CVE-2024-27304 | http://nvd.nist.gov/ |
| glibc | CVE-2024-2961, CVE-2024-33599, CVE-2024-33600 | http://nvd.nist.gov/ |
| golang.org/x/crypto | CVE-2022-27191 | http://nvd.nist.gov/ |
| java-17-openjdk | CVE-2024-20918, CVE-2024-20932, CVE-2024-20952, CVE-2024-21147 | http://nvd.nist.gov/ |
| keycloak-core | CVE-2024-10039, CVE-2023-6841 | http://nvd.nist.gov/ |
| keycloak-quarkus-server | CVE-2024-10451 | http://nvd.nist.gov/ |
| keycloak-saml-core | CVE-2024-8698 | http://nvd.nist.gov/ |
| keycloak-services | CVE-2024-3656, CVE-2024-7341, CVE-2024-4540, CVE-2024-1132, CVE-2024-1249, CVE-2023-6291, CVE-2024-2419, CVE-2024-10270 | http://nvd.nist.gov/ |
| krb5 | CVE-2024-26458, CVE-2024-26461, CVE-2024-26462, CVE-2024-37370 | http://nvd.nist.gov/ |
| libxml2-2 | CVE-2024-56171 | http://nvd.nist.gov/ |
| nokogiri | CVE-2025-24855, CVE-2024-55549 | http://nvd.nist.gov/ |
| postgresql15 | CVE-2025-1094 | http://nvd.nist.gov/ |
| rexml | CVE-2021-28965, CVE-2024-43398 | http://nvd.nist.gov/ |
| go-grpc-compression | CVE-2024-36129 | http://nvd.nist.gov/ |
| stdlib | CVE-2022-30632, CVE-2023-45288, CVE-2024-24791, CVE-2024-34156 | http://nvd.nist.gov/ |
| Keycloak | CVE-2025-7962, CVE-2025-49574, CVE-2025-55163, CVE-2025-58057, CVE-2025-48924, CVE-2025-9162, CVE-2025-8419, CVE-2025-7784, CVE-2025-7365, CVE-2025-50106, CVE-2025-30749 | http://nvd.nist.gov/ |
| SQLite | CVE-2023-7104 | http://nvd.nist.gov/ |
| Python | CVE-2024-35195, CVE-2022-40899, CVE-2024-6345 | http://nvd.nist.gov/ |
| CPython | CVE-2024-7592, CVE-2024-6232, CVE-2024-3219, CVE-2024-6923 | http://nvd.nist.gov/ |
| urllib3 | CVE-2024-37891 | http://nvd.nist.gov/ |
| Python-Requests | CVE-2023-32681 | http://nvd.nist.gov/ |
| XZ Utils | CVE-2024-47611, CVE-2020-22916 | http://nvd.nist.gov/ |
| Proprietary Code CVE | Description | CVSS Base Score | CVSS Vector String |
| CVE-2025-46371 | Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) a Use of a Broken or Risky Cryptographic Algorithm vulnerability in the ssh. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass. | 3.6 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N |
| CVE-2025-32751 | Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Insecure Storage of Sensitive Information vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to unauthorized access to sensitive information. | 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| CVE-2025-32750 | Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Exposure of Information Through Directory Listing vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information exposure. | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CVE-2025-32749 | Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges. | 5.3 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| CVE-2025-32747 | Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Incorrect Privilege Assignment vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges. | 5.3 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| CVE-2025-32746 | Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Insecure Storage of Sensitive Information vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to unauthorized access to sensitive information. | 4.0 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| CVE-2025-32745 | Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information tampering. | 4.2 | CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N |
| CVE-2025-26483 | Dell PowerFlex Manager, versions 4.6.2 and prior, contains an Open Redirect Vulnerability. An unauthenticated attacker could potentially exploit this vulnerability, leading to a targeted application user being redirected to arbitrary web URLs. The vulnerability could be leveraged by attackers to conduct phishing attacks that cause users to divulge sensitive information. | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| Proprietary Code CVE | Description | CVSS Base Score | CVSS Vector String |
| CVE-2025-46371 | Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) a Use of a Broken or Risky Cryptographic Algorithm vulnerability in the ssh. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass. | 3.6 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N |
| CVE-2025-32751 | Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Insecure Storage of Sensitive Information vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to unauthorized access to sensitive information. | 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| CVE-2025-32750 | Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Exposure of Information Through Directory Listing vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information exposure. | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CVE-2025-32749 | Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges. | 5.3 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| CVE-2025-32747 | Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Incorrect Privilege Assignment vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges. | 5.3 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| CVE-2025-32746 | Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Insecure Storage of Sensitive Information vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to unauthorized access to sensitive information. | 4.0 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| CVE-2025-32745 | Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information tampering. | 4.2 | CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N |
| CVE-2025-26483 | Dell PowerFlex Manager, versions 4.6.2 and prior, contains an Open Redirect Vulnerability. An unauthenticated attacker could potentially exploit this vulnerability, leading to a targeted application user being redirected to arbitrary web URLs. The vulnerability could be leveraged by attackers to conduct phishing attacks that cause users to divulge sensitive information. | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Produits concernés et mesure corrective
| Product | Software/Firmware | Affected Versions | Remediated Versions | Link |
| PowerFlex Software | Software | Versions prior to 4.8.0 | Version 4.8.0 | RCM release |
| Product | Software/Firmware | Affected Versions | Remediated Versions | Link |
| PowerFlex Software | Software | Versions prior to 4.8.0 | Version 4.8.0 | RCM release |
In the case of manual upgrade for PowerFlex Software, please see this link: https://www.dell.com/support/product-details/en-us/product/scaleio/drivers
Historique des révisions
| Revision | Date | Description |
| 1.0 | 2025-11-13 | Initial Release |
| 2.0 | 2025-11-17 | Updated CVE Identifier, Third Party Components: Added CVE-2025-49844, CVE-2025-46817, CVE-2025-46818, CVE-2025-46819 |
| 3.0 | 2025-12-11 | Update addressed 41 CVEs in Third Party Components |
| 4.0 | 2026-01-20 | Updated CVE Identifier, Third Party Components: Added Keycloak 11 CVEs |
| 5.0 | 2026-04-24 | formating data to link some CVEs to their OSS Library |
Informations connexes
Mention légale
Produits concernés
PowerFlex SoftwarePropriétés de l’article
Numéro d’article: 000391573
Type d’article: Dell Security Advisory
Dernière modification: 24 Apr 2026
Trouvez des réponses à vos questions auprès d’autres utilisateurs Dell
Services de support
Vérifiez si votre appareil est couvert par les services de support.