Dell EMC OpenManage Enterprise Services False Positive Security Vulnerabilities

Sammendrag: This article provides a list of security vulnerabilities that cannot be exploited on the Dell EMC OpenManage Enterprise Services 1.2.1 and earlier versions but which may be identified by security scanners. ...

Denne artikkelen gjelder for Denne artikkelen gjelder ikke for Denne artikkelen er ikke knyttet til noe bestemt produkt. Det er ikke produktversjonene som identifiseres i denne artikkelen.
Ta en titt på andre ressurser

Type sikkerhetsartikkel

Security KB

CVE-identifikator

The CVE IDs are listed in the table below.

Problemsammendrag

This article provides a list of security vulnerabilities that cannot be exploited on Dell EMC Open Manage Enterprise Services 1.2.1 and earlier versions but which may be identified by security scanners.

Detaljer

See the 'Recommendation' section below for details on each CVE.

Anbefalinger

The vulnerabilities listed in the table below are in order by the date on which Dell EMC OpenManage Enterprise Services Engineering determined that Dell EMC OpenManage Enterprise Services version 1.2.1 and earlier versions were not vulnerable. 
 
Third-party Component CVE IDs Summary of Vulnerability Reason why Product is not Vulnerable Date Determined False Positive
Log4j-2.16 CVE-2021-45105 Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This may allow an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was addressed in Log4j 2.17.0, 2.12.3, and 2.3.1.

Details from https://logging.apache.org/log4j/2.x/security.html:
Alternatively, this infinite recursion issue can be mitigated in configuration:
  • In PatternLayout in the logging configuration, replace Context Lookups like ${ctx:loginId} or $${ctx:loginId} with Thread Context Map patterns (%X, %mdc, or %MDC).
  • Otherwise, in the configuration, remove references to Context Lookups like ${ctx:loginId} or $${ctx:loginId} where they originate from sources external to the application such as HTTP headers or user input.
 Dell EMC OpenManage Enterprise Services is not using context lookup in pattern layout logging configuration. Dec. 17, 2021
Log4j-2.16 CVE-2021-44832 Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack where an attacker with permission to modify the logging configuration file may construct a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI which can execute remote code. Dell EMC OpenManage Enterprise Services (OMES) does not use JDBCAppender configurations. Jan. 6, 2022

Tilleggsinformasjon

Note: Dell EMC OpenManage Enterprise Services version 1.2.2 released on February 8, 2022 includes the update to Log4j 2.17.1. Dell EMC OpenManage Enterprise Services version 1.2.2 download link: https://www.dell.com/support/home/en-us/drivers/driversdetails?driverid=99M1R.

Juridisk ansvarsfraskrivelse

Berørte produkter

OpenManage Enterprise Services, Product Security Information
Artikkelegenskaper
Artikkelnummer: 000195420
Artikkeltype: Security KB
Sist endret: 14 feb. 2022
Versjon:  2
Få svar på spørsmålene dine fra andre Dell-brukere
Støttetjenester
Sjekk om enheten din er dekket av støttetjenestene.