DSA-2019-021: Dell EMC Data Computing Appliance (DCA) Security Update for Multiple Vulnerabilities in Embedded Components

Multiple components within the Dell EMC DCA have been updated to address various vulnerabilities. The embedded components are updated for the following vulnerabilities:     

• Kernel vulnerabilities

CVE-2018-14634    CVE-2018-5391

• httpd vulnerabilities

CVE-2017-12171    CVE-2017-9798

• nss vulnerabilities

CVE-2018-12384

• gnupg2 vulnerabilities

CVE-2018-12020

• Python-paramiko vulnerabilities

CVE-2018-1000805

• Openjdk vulnerabilities 

CVE-2018-3136    CVE-2018-3139    CVE-2018-3149    CVE-2018-3169
CVE-2018-3180    CVE-2018-3214

• OpenSSH vulnerabilities

CVE-2016-6210

For more information about any of the Common Vulnerabilities and Exposures (CVEs) mentioned here, consult the National Vulnerability Database (NVD) at http://nvd.nist.gov/home.cfm.

To search for a particular CVE, use the database s search utility at http://web.nvd.nist.gov/view/vuln/search.

Affected products:      
Dell EMC Data Computing Appliance (DCA) versions prior to 3.5.2.0


Remediation:     
The following Dell EMC DCA release addresses these vulnerabilities:     

• Dell EMC DCA 3.5.2.0

For Dell EMC DCA version 3.5.2.0 and later, the security update is contained in release 3.5.2.0.

Dell EMC recommends all customers upgrade at the earliest opportunity. Contact Dell EMC DCA customer support to download the required rpm file and install it.


Link to Remedies:      
Only authorized Dell EMC Customer Support personnel can download Dell EMC DCA software version 3.5.2.0 from Dell EMC Online Support. Customers must call Dell EMC Support to schedule an upgrade to DCA 3.5.2.0.