Security Bulletin: This Power System update is being released to address CVE 2020-10735

Summary

BMC firmware version OP910 uses Python to help serve HTTPS requests but Python is not used to process the request body, so this access vector is not vulnerable the Python long integer vulnerability. A BMC administrator who uses Python from the BMC’s command line is subject to this vulnerability.

Vulnerability Details

CVEID:CVE-2020-10735
**DESCRIPTION:**Python is vulnerable to a denial of service, caused by the failure to limit amount of digits converting text to int by the int() type in PyLong_FromString(). A remote attacker could exploit this vulnerability to consume all available resources.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/235840 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Remediation/Fixes

Customers with the products below should install OP910.80 or newer to remediate this vulnerability.

Power 9

1. IBM Power System AC922 (8335-GTG)

Customers with the products below should install OP910.80C or newer to remediate this vulnerability.

Power 9

1. IBM Power System AC922 (8335-GTC, 8335-GTW)

Workarounds and Mitigations

Avoid using Python to convert integers longer than 4300 digits.