DSA-2021-201: Dell PowerScale OneFS Security Update for Multiple Vulnerabilities
Resumo: Dell PowerScale OneFS remediation is available for multiple vulnerabilities that could be exploited by malicious users to compromise the affected system.
Este artigo aplica-se a
Este artigo não se aplica a
Este artigo não está vinculado a nenhum produto específico.
Nem todas as versões do produto estão identificadas neste artigo.
Impacto
Critical
Dados
| Proprietary Code CVEs | Description | CVSS Base Score | CVSS Vector String |
| CVE-2021-21528 | Dell EMC PowerScale OneFS versions 9.1.0, 9.2.0.x, and 9.2.1.x contain an Exposure of Information through Directory Listing vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to gain unauthorized access to the filesystem. | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CVE-2021-36315 | Dell EMC PowerScale Nodes contain a hardware design flaw. This may allow a local unauthenticated user to escalate privileges. This also affects Compliance mode and for Compliance mode clusters, is a critical vulnerability. Dell EMC recommends applying the workaround at your earliest opportunity. | 6.8 | CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Third-party Component | CVE | More information |
| Python | CVE-2019-20907 | https://nvd.nist.gov/vuln/detail/CVE-2019-20907 |
| cURL | Multiple CVEs | https://curl.se/docs/vuln-7.77.0.html |
| Proprietary Code CVEs | Description | CVSS Base Score | CVSS Vector String |
| CVE-2021-21528 | Dell EMC PowerScale OneFS versions 9.1.0, 9.2.0.x, and 9.2.1.x contain an Exposure of Information through Directory Listing vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to gain unauthorized access to the filesystem. | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CVE-2021-36315 | Dell EMC PowerScale Nodes contain a hardware design flaw. This may allow a local unauthenticated user to escalate privileges. This also affects Compliance mode and for Compliance mode clusters, is a critical vulnerability. Dell EMC recommends applying the workaround at your earliest opportunity. | 6.8 | CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Third-party Component | CVE | More information |
| Python | CVE-2019-20907 | https://nvd.nist.gov/vuln/detail/CVE-2019-20907 |
| cURL | Multiple CVEs | https://curl.se/docs/vuln-7.77.0.html |
Produtos afetados e soluções
| CVEs Addressed | Affected Versions | Updated Versions | Link to Update | |
| CVE-2019-20907 | 8.2.0, 8.2.1, 9.0.0.x, 9.2.0.x, 9.1.1.x | Upgrade your version of OneFS | ||
| 8.2.2, 9.1.0.x , 9.2.1.x | Download and install the latest RUP | |||
| CVE-2021-21528 | 9.2.0.x | Upgrade your version of OneFS | PowerScale OneFS Downloads Area | |
| 9.1.0.x , 9.2.1.x | Download and install the latest RUP | |||
| CVE-2021-36315 | A100, S210, X410, H400, X210, NL410, A200, A2000, H400, H500, H600, H5600, F800, F810,F200, F600, A300, A3000, H700, H7000 |
See Knowledge Article 192465: [Isilon] How to enable/disable USB boot and/or secure the BIOS on Isilon nodes. |
||
| See the PowerScale Security Configuration Guide Section: Disable USB Boot on nodes. |
||||
Note: The above table may not be a comprehensive list of all affected supported versions and may be updated as more information becomes available.
| CVEs Addressed | Affected Versions | Updated Versions | Link to Update | |
| CVE-2019-20907 | 8.2.0, 8.2.1, 9.0.0.x, 9.2.0.x, 9.1.1.x | Upgrade your version of OneFS | ||
| 8.2.2, 9.1.0.x , 9.2.1.x | Download and install the latest RUP | |||
| CVE-2021-21528 | 9.2.0.x | Upgrade your version of OneFS | PowerScale OneFS Downloads Area | |
| 9.1.0.x , 9.2.1.x | Download and install the latest RUP | |||
| CVE-2021-36315 | A100, S210, X410, H400, X210, NL410, A200, A2000, H400, H500, H600, H5600, F800, F810,F200, F600, A300, A3000, H700, H7000 |
See Knowledge Article 192465: [Isilon] How to enable/disable USB boot and/or secure the BIOS on Isilon nodes. |
||
| See the PowerScale Security Configuration Guide Section: Disable USB Boot on nodes. |
||||
Note: The above table may not be a comprehensive list of all affected supported versions and may be updated as more information becomes available.
Soluções temporárias e atenuações
| Workarounds or Mitigations | |
| CVE-2021-21528 | Verify that a value for redirect flag is set. Check the current gconfig value: # isi_gconfig -q -t http-config redirectIf nothing is returned, this means the value has not been set, and is using defaults. This must be set to true: # isi_gconfig -q -t http-config redirect=trueConfirm the value is now set: # isi_gconfig -q -t http-config redirect |
| In Compliance Mode: Verify that a value for redirect flag is set. Check the current gconfig value: # sudo isi_gconfig -q -t http-config redirectIf nothing is returned, this means the value has not been set, and is using defaults. This must be set to true: # sudo isi_gconfig -q -t http-config redirect=trueConfirm the value is now set: # sudo isi_gconfig -q -t http-config redirect |
|
| CVE-2021-36315 | See the PowerScale Security Configuration Guide |
| Python | None |
| cURL | None |
Histórico de revisão
| Revision | Date | Description |
| 1.0 | 2021-10-28 | Initial Release |
| 2.0 | 2021-11-08 | Links and CVEs updated |
Informações relacionadas
Aviso de isenção legal
Produtos afetados
Isilon A100, Isilon A200, Isilon A2000, Isilon F800, Isilon F810, Isilon H400, Isilon H500, Isilon H600, Isilon NL410, PowerScale OneFS, Isilon S210, Isilon X210, Isilon X410, PowerScale Archive A300, PowerScale Archive A3000, PowerScale F200
, PowerScale F600, PowerScale Hybrid H700, PowerScale Hybrid H7000, Product Security Information
...
Propriedades do artigo
Número do artigo: 000193005
Tipo de artigo: Dell Security Advisory
Último modificado: 15 fev. 2022
Encontre as respostas de outros usuários da Dell para suas perguntas.
Serviços de suporte
Verifique se o dispositivo está coberto pelos serviços de suporte.