Security Bulletin: PowerHA System Mirror for AIX vulnerability

Summary

IBM PowerHA could allow a local attacker to obtain sensitive information from temporary directories after a discovery failure occurs.

Vulnerability Details

CVEID:CVE-2020-4832
**DESCRIPTION:**IBM PowerHA could allow a local attacker to obtain sensitive information from temporary directories after a discovery failure occurs.
CVSS Base score: 6.2
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/189969 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

Remediation/Fixes

PowerHA System Mirror for AIX - 7.2.4 SP2

https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Cluster%20software&product=ibm/Other+software/PowerHAClusterManager&release=7.2.4&platform=AIX&function=all

PowerHA System Mirror for AIX - 7.2.3 SP4

https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Cluster%20software&product=ibm/Other+software/PowerHAClusterManager&release=7.2.3&platform=AIX&function=all

PowerHA System Mirror for AIX - 7.2.2 SP5

https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Cluster%20software&product=ibm/Other+software/PowerHAClusterManager&release=7.2.2&platform=AIX&function=all

Workarounds and Mitigations

None