DSA-2021-201: Dell PowerScale OneFS Security Update for Multiple Vulnerabilities
Samenvatting: Dell PowerScale OneFS remediation is available for multiple vulnerabilities that could be exploited by malicious users to compromise the affected system.
Dit artikel is van toepassing op
Dit artikel is niet van toepassing op
Dit artikel is niet gebonden aan een specifiek product.
Niet alle productversies worden in dit artikel vermeld.
Impact
Critical
Gegevens
| Proprietary Code CVEs | Description | CVSS Base Score | CVSS Vector String |
| CVE-2021-21528 | Dell EMC PowerScale OneFS versions 9.1.0, 9.2.0.x, and 9.2.1.x contain an Exposure of Information through Directory Listing vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to gain unauthorized access to the filesystem. | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CVE-2021-36315 | Dell EMC PowerScale Nodes contain a hardware design flaw. This may allow a local unauthenticated user to escalate privileges. This also affects Compliance mode and for Compliance mode clusters, is a critical vulnerability. Dell EMC recommends applying the workaround at your earliest opportunity. | 6.8 | CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Third-party Component | CVE | More information |
| Python | CVE-2019-20907 | https://nvd.nist.gov/vuln/detail/CVE-2019-20907 |
| cURL | Multiple CVEs | https://curl.se/docs/vuln-7.77.0.html |
| Proprietary Code CVEs | Description | CVSS Base Score | CVSS Vector String |
| CVE-2021-21528 | Dell EMC PowerScale OneFS versions 9.1.0, 9.2.0.x, and 9.2.1.x contain an Exposure of Information through Directory Listing vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to gain unauthorized access to the filesystem. | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CVE-2021-36315 | Dell EMC PowerScale Nodes contain a hardware design flaw. This may allow a local unauthenticated user to escalate privileges. This also affects Compliance mode and for Compliance mode clusters, is a critical vulnerability. Dell EMC recommends applying the workaround at your earliest opportunity. | 6.8 | CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Third-party Component | CVE | More information |
| Python | CVE-2019-20907 | https://nvd.nist.gov/vuln/detail/CVE-2019-20907 |
| cURL | Multiple CVEs | https://curl.se/docs/vuln-7.77.0.html |
Getroffen producten en herstel
| CVEs Addressed | Affected Versions | Updated Versions | Link to Update | |
| CVE-2019-20907 | 8.2.0, 8.2.1, 9.0.0.x, 9.2.0.x, 9.1.1.x | Upgrade your version of OneFS | ||
| 8.2.2, 9.1.0.x , 9.2.1.x | Download and install the latest RUP | |||
| CVE-2021-21528 | 9.2.0.x | Upgrade your version of OneFS | PowerScale OneFS Downloads Area | |
| 9.1.0.x , 9.2.1.x | Download and install the latest RUP | |||
| CVE-2021-36315 | A100, S210, X410, H400, X210, NL410, A200, A2000, H400, H500, H600, H5600, F800, F810,F200, F600, A300, A3000, H700, H7000 |
See Knowledge Article 192465: [Isilon] How to enable/disable USB boot and/or secure the BIOS on Isilon nodes. |
||
| See the PowerScale Security Configuration Guide Section: Disable USB Boot on nodes. |
||||
Note: The above table may not be a comprehensive list of all affected supported versions and may be updated as more information becomes available.
| CVEs Addressed | Affected Versions | Updated Versions | Link to Update | |
| CVE-2019-20907 | 8.2.0, 8.2.1, 9.0.0.x, 9.2.0.x, 9.1.1.x | Upgrade your version of OneFS | ||
| 8.2.2, 9.1.0.x , 9.2.1.x | Download and install the latest RUP | |||
| CVE-2021-21528 | 9.2.0.x | Upgrade your version of OneFS | PowerScale OneFS Downloads Area | |
| 9.1.0.x , 9.2.1.x | Download and install the latest RUP | |||
| CVE-2021-36315 | A100, S210, X410, H400, X210, NL410, A200, A2000, H400, H500, H600, H5600, F800, F810,F200, F600, A300, A3000, H700, H7000 |
See Knowledge Article 192465: [Isilon] How to enable/disable USB boot and/or secure the BIOS on Isilon nodes. |
||
| See the PowerScale Security Configuration Guide Section: Disable USB Boot on nodes. |
||||
Note: The above table may not be a comprehensive list of all affected supported versions and may be updated as more information becomes available.
Tijdelijke oplossingen en risicobeperking
| Workarounds or Mitigations | |
| CVE-2021-21528 | Verify that a value for redirect flag is set. Check the current gconfig value: # isi_gconfig -q -t http-config redirectIf nothing is returned, this means the value has not been set, and is using defaults. This must be set to true: # isi_gconfig -q -t http-config redirect=trueConfirm the value is now set: # isi_gconfig -q -t http-config redirect |
| In Compliance Mode: Verify that a value for redirect flag is set. Check the current gconfig value: # sudo isi_gconfig -q -t http-config redirectIf nothing is returned, this means the value has not been set, and is using defaults. This must be set to true: # sudo isi_gconfig -q -t http-config redirect=trueConfirm the value is now set: # sudo isi_gconfig -q -t http-config redirect |
|
| CVE-2021-36315 | See the PowerScale Security Configuration Guide |
| Python | None |
| cURL | None |
Revisiegeschiedenis
| Revision | Date | Description |
| 1.0 | 2021-10-28 | Initial Release |
| 2.0 | 2021-11-08 | Links and CVEs updated |
Verwante informatie
Juridische verklaring van afstand
Getroffen producten
Isilon A100, Isilon A200, Isilon A2000, Isilon F800, Isilon F810, Isilon H400, Isilon H500, Isilon H600, Isilon NL410, PowerScale OneFS, Isilon S210, Isilon X210, Isilon X410, PowerScale Archive A300, PowerScale Archive A3000, PowerScale F200
, PowerScale F600, PowerScale Hybrid H700, PowerScale Hybrid H7000, Product Security Information
...
Artikeleigenschappen
Artikelnummer: 000193005
Artikeltype: Dell Security Advisory
Laatst aangepast: 15 feb. 2022
Vind antwoorden op uw vragen via andere Dell gebruikers
Support Services
Controleer of uw apparaat wordt gedekt door Support Services.