DSA-2021-201: Dell PowerScale OneFS Security Update for Multiple Vulnerabilities
Zhrnutie: Dell PowerScale OneFS remediation is available for multiple vulnerabilities that could be exploited by malicious users to compromise the affected system.
Tento článok sa vzťahuje na
Tento článok sa nevzťahuje na
Tento článok nie je viazaný na žiadny konkrétny produkt.
V tomto článku nie sú uvedené všetky verzie produktov.
Dosah
Critical
Podrobnosti
| Proprietary Code CVEs | Description | CVSS Base Score | CVSS Vector String |
| CVE-2021-21528 | Dell EMC PowerScale OneFS versions 9.1.0, 9.2.0.x, and 9.2.1.x contain an Exposure of Information through Directory Listing vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to gain unauthorized access to the filesystem. | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CVE-2021-36315 | Dell EMC PowerScale Nodes contain a hardware design flaw. This may allow a local unauthenticated user to escalate privileges. This also affects Compliance mode and for Compliance mode clusters, is a critical vulnerability. Dell EMC recommends applying the workaround at your earliest opportunity. | 6.8 | CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Third-party Component | CVE | More information |
| Python | CVE-2019-20907 | https://nvd.nist.gov/vuln/detail/CVE-2019-20907 |
| cURL | Multiple CVEs | https://curl.se/docs/vuln-7.77.0.html |
| Proprietary Code CVEs | Description | CVSS Base Score | CVSS Vector String |
| CVE-2021-21528 | Dell EMC PowerScale OneFS versions 9.1.0, 9.2.0.x, and 9.2.1.x contain an Exposure of Information through Directory Listing vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to gain unauthorized access to the filesystem. | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CVE-2021-36315 | Dell EMC PowerScale Nodes contain a hardware design flaw. This may allow a local unauthenticated user to escalate privileges. This also affects Compliance mode and for Compliance mode clusters, is a critical vulnerability. Dell EMC recommends applying the workaround at your earliest opportunity. | 6.8 | CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Third-party Component | CVE | More information |
| Python | CVE-2019-20907 | https://nvd.nist.gov/vuln/detail/CVE-2019-20907 |
| cURL | Multiple CVEs | https://curl.se/docs/vuln-7.77.0.html |
Dotknuté produkty a riešenie problému
| CVEs Addressed | Affected Versions | Updated Versions | Link to Update | |
| CVE-2019-20907 | 8.2.0, 8.2.1, 9.0.0.x, 9.2.0.x, 9.1.1.x | Upgrade your version of OneFS | ||
| 8.2.2, 9.1.0.x , 9.2.1.x | Download and install the latest RUP | |||
| CVE-2021-21528 | 9.2.0.x | Upgrade your version of OneFS | PowerScale OneFS Downloads Area | |
| 9.1.0.x , 9.2.1.x | Download and install the latest RUP | |||
| CVE-2021-36315 | A100, S210, X410, H400, X210, NL410, A200, A2000, H400, H500, H600, H5600, F800, F810,F200, F600, A300, A3000, H700, H7000 |
See Knowledge Article 192465: [Isilon] How to enable/disable USB boot and/or secure the BIOS on Isilon nodes. |
||
| See the PowerScale Security Configuration Guide Section: Disable USB Boot on nodes. |
||||
Note: The above table may not be a comprehensive list of all affected supported versions and may be updated as more information becomes available.
| CVEs Addressed | Affected Versions | Updated Versions | Link to Update | |
| CVE-2019-20907 | 8.2.0, 8.2.1, 9.0.0.x, 9.2.0.x, 9.1.1.x | Upgrade your version of OneFS | ||
| 8.2.2, 9.1.0.x , 9.2.1.x | Download and install the latest RUP | |||
| CVE-2021-21528 | 9.2.0.x | Upgrade your version of OneFS | PowerScale OneFS Downloads Area | |
| 9.1.0.x , 9.2.1.x | Download and install the latest RUP | |||
| CVE-2021-36315 | A100, S210, X410, H400, X210, NL410, A200, A2000, H400, H500, H600, H5600, F800, F810,F200, F600, A300, A3000, H700, H7000 |
See Knowledge Article 192465: [Isilon] How to enable/disable USB boot and/or secure the BIOS on Isilon nodes. |
||
| See the PowerScale Security Configuration Guide Section: Disable USB Boot on nodes. |
||||
Note: The above table may not be a comprehensive list of all affected supported versions and may be updated as more information becomes available.
Alternatívne riešenia a zmiernenia
| Workarounds or Mitigations | |
| CVE-2021-21528 | Verify that a value for redirect flag is set. Check the current gconfig value: # isi_gconfig -q -t http-config redirectIf nothing is returned, this means the value has not been set, and is using defaults. This must be set to true: # isi_gconfig -q -t http-config redirect=trueConfirm the value is now set: # isi_gconfig -q -t http-config redirect |
| In Compliance Mode: Verify that a value for redirect flag is set. Check the current gconfig value: # sudo isi_gconfig -q -t http-config redirectIf nothing is returned, this means the value has not been set, and is using defaults. This must be set to true: # sudo isi_gconfig -q -t http-config redirect=trueConfirm the value is now set: # sudo isi_gconfig -q -t http-config redirect |
|
| CVE-2021-36315 | See the PowerScale Security Configuration Guide |
| Python | None |
| cURL | None |
História revízií
| Revision | Date | Description |
| 1.0 | 2021-10-28 | Initial Release |
| 2.0 | 2021-11-08 | Links and CVEs updated |
Súvisiace informácie
Legal Disclaimer
Dotknuté produkty
Isilon A100, Isilon A200, Isilon A2000, Isilon F800, Isilon F810, Isilon H400, Isilon H500, Isilon H600, Isilon NL410, PowerScale OneFS, Isilon S210, Isilon X210, Isilon X410, PowerScale Archive A300, PowerScale Archive A3000, PowerScale F200
, PowerScale F600, PowerScale Hybrid H700, PowerScale Hybrid H7000, Product Security Information
...
Vlastnosti článku
Číslo článku: 000193005
Typ článku: Dell Security Advisory
Dátum poslednej úpravy: 15 feb 2022
Nájdite odpovede na svoje otázky od ostatných používateľov spoločnosti Dell
Služby podpory
Skontrolujte, či sa na vaše zariadenie vzťahujú služby podpory.