5.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:P/A:N
PowerKVM is affected by a vulnerability in Python. IBM has now addressed this vulnerability.
CVEID: CVE-2014-9365**
DESCRIPTION:** Python could allow a remote attacker to bypass security restrictions, caused by the failure to validate TLS certificate by the HTTP libraries. By persuading a victim to visit a specially-crafted Web site, an attacker could exploit this vulnerability using man-in-the-middle techniques to launch further attacks on the system.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/99294 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)
PowerKVM 2.1 and 3.1
Customers can update PowerKVM systems by using “yum update”.
Fix images are made available via Fix Central. For version 3.1, see https://ibm.biz/BdHggw. This issue is addressed starting with v3.1.0.2 update 10.
For version 2.1, see https://ibm.biz/BdEnT8. This issue is addressed starting with PowerKVM 2.1.1.3-65 update 19. Customers running v2.1 are, in any case, encouraged to upgrade to v3.1.
For v2.1 systems currently running fix levels of PowerKVM prior to 2.1.1, please see <http://download4.boulder.ibm.com/sar/CMA/OSA/05e4c/0/README> for prerequisite fixes and instructions.
none