Security Bulletin: A vulnerability in gnupg2 affects PowerKVM

Summary

PowerKVM is affected by a vulnerability in gnupg2. IBM has now addressed this vulnerability.

Vulnerability Details

CVEID: CVE-2018-12020 DESCRIPTION: GnuPG could allow a remote attacker to conduct spoofing attacks, caused by the improper handling of the original filename during decryption and verification actions in mainproc.c. An attacker could exploit this vulnerability to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the --status-fd 2 option.
CVSS Base Score: 5.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/144556&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Affected Products and Versions

PowerKVM v3.1

Remediation/Fixes

Customers can update PowerKVM systems by using “yum update”.

Fix images are made available via Fix Central. See <https://ibm.biz/BdHggw&gt;. This issue is addressed starting with v3.1.0.2 update 15.

Workarounds and Mitigations

none