DSA-2021-201: Dell PowerScale OneFS Security Update for Multiple Vulnerabilities
Résumé: Dell PowerScale OneFS remediation is available for multiple vulnerabilities that could be exploited by malicious users to compromise the affected system.
Cet article concerne
Cet article ne concerne pas
Cet article n’est associé à aucun produit spécifique.
Toutes les versions du produit ne sont pas identifiées dans cet article.
Impact
Critical
Détails
| Proprietary Code CVEs | Description | CVSS Base Score | CVSS Vector String |
| CVE-2021-21528 | Dell EMC PowerScale OneFS versions 9.1.0, 9.2.0.x, and 9.2.1.x contain an Exposure of Information through Directory Listing vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to gain unauthorized access to the filesystem. | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CVE-2021-36315 | Dell EMC PowerScale Nodes contain a hardware design flaw. This may allow a local unauthenticated user to escalate privileges. This also affects Compliance mode and for Compliance mode clusters, is a critical vulnerability. Dell EMC recommends applying the workaround at your earliest opportunity. | 6.8 | CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Third-party Component | CVE | More information |
| Python | CVE-2019-20907 | https://nvd.nist.gov/vuln/detail/CVE-2019-20907 |
| cURL | Multiple CVEs | https://curl.se/docs/vuln-7.77.0.html |
| Proprietary Code CVEs | Description | CVSS Base Score | CVSS Vector String |
| CVE-2021-21528 | Dell EMC PowerScale OneFS versions 9.1.0, 9.2.0.x, and 9.2.1.x contain an Exposure of Information through Directory Listing vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to gain unauthorized access to the filesystem. | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CVE-2021-36315 | Dell EMC PowerScale Nodes contain a hardware design flaw. This may allow a local unauthenticated user to escalate privileges. This also affects Compliance mode and for Compliance mode clusters, is a critical vulnerability. Dell EMC recommends applying the workaround at your earliest opportunity. | 6.8 | CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Third-party Component | CVE | More information |
| Python | CVE-2019-20907 | https://nvd.nist.gov/vuln/detail/CVE-2019-20907 |
| cURL | Multiple CVEs | https://curl.se/docs/vuln-7.77.0.html |
Produits concernés et mesure corrective
| CVEs Addressed | Affected Versions | Updated Versions | Link to Update | |
| CVE-2019-20907 | 8.2.0, 8.2.1, 9.0.0.x, 9.2.0.x, 9.1.1.x | Upgrade your version of OneFS | ||
| 8.2.2, 9.1.0.x , 9.2.1.x | Download and install the latest RUP | |||
| CVE-2021-21528 | 9.2.0.x | Upgrade your version of OneFS | PowerScale OneFS Downloads Area | |
| 9.1.0.x , 9.2.1.x | Download and install the latest RUP | |||
| CVE-2021-36315 | A100, S210, X410, H400, X210, NL410, A200, A2000, H400, H500, H600, H5600, F800, F810,F200, F600, A300, A3000, H700, H7000 |
See Knowledge Article 192465: [Isilon] How to enable/disable USB boot and/or secure the BIOS on Isilon nodes. |
||
| See the PowerScale Security Configuration Guide Section: Disable USB Boot on nodes. |
||||
Note: The above table may not be a comprehensive list of all affected supported versions and may be updated as more information becomes available.
| CVEs Addressed | Affected Versions | Updated Versions | Link to Update | |
| CVE-2019-20907 | 8.2.0, 8.2.1, 9.0.0.x, 9.2.0.x, 9.1.1.x | Upgrade your version of OneFS | ||
| 8.2.2, 9.1.0.x , 9.2.1.x | Download and install the latest RUP | |||
| CVE-2021-21528 | 9.2.0.x | Upgrade your version of OneFS | PowerScale OneFS Downloads Area | |
| 9.1.0.x , 9.2.1.x | Download and install the latest RUP | |||
| CVE-2021-36315 | A100, S210, X410, H400, X210, NL410, A200, A2000, H400, H500, H600, H5600, F800, F810,F200, F600, A300, A3000, H700, H7000 |
See Knowledge Article 192465: [Isilon] How to enable/disable USB boot and/or secure the BIOS on Isilon nodes. |
||
| See the PowerScale Security Configuration Guide Section: Disable USB Boot on nodes. |
||||
Note: The above table may not be a comprehensive list of all affected supported versions and may be updated as more information becomes available.
Solutions de contournement et mesures d’atténuation
| Workarounds or Mitigations | |
| CVE-2021-21528 | Verify that a value for redirect flag is set. Check the current gconfig value: # isi_gconfig -q -t http-config redirectIf nothing is returned, this means the value has not been set, and is using defaults. This must be set to true: # isi_gconfig -q -t http-config redirect=trueConfirm the value is now set: # isi_gconfig -q -t http-config redirect |
| In Compliance Mode: Verify that a value for redirect flag is set. Check the current gconfig value: # sudo isi_gconfig -q -t http-config redirectIf nothing is returned, this means the value has not been set, and is using defaults. This must be set to true: # sudo isi_gconfig -q -t http-config redirect=trueConfirm the value is now set: # sudo isi_gconfig -q -t http-config redirect |
|
| CVE-2021-36315 | See the PowerScale Security Configuration Guide |
| Python | None |
| cURL | None |
Historique des révisions
| Revision | Date | Description |
| 1.0 | 2021-10-28 | Initial Release |
| 2.0 | 2021-11-08 | Links and CVEs updated |
Informations connexes
Mention légale
Produits concernés
Isilon A100, Isilon A200, Isilon A2000, Isilon F800, Isilon F810, Isilon H400, Isilon H500, Isilon H600, Isilon NL410, PowerScale OneFS, Isilon S210, Isilon X210, Isilon X410, PowerScale Archive A300, PowerScale Archive A3000, PowerScale F200
, PowerScale F600, PowerScale Hybrid H700, PowerScale Hybrid H7000, Product Security Information
...
Propriétés de l’article
Numéro d’article: 000193005
Type d’article: Dell Security Advisory
Dernière modification: 15 Feb 2022
Trouvez des réponses à vos questions auprès d’autres utilisateurs Dell
Services de support
Vérifiez si votre appareil est couvert par les services de support.