Security Bulletin: IBM RackSwitch firmware products are affected by vulnerability in Python (CVE-2017-1000158)

Summary

Vulnerability in Python has been addressed by IBM RackSwitch firmware products listed below.

Vulnerability Details

CVEID: CVE-2017-1000158 DESCRIPTION: CPython is vulnerable to a heap-based buffer overflow, caused by an integer overflow in the PyString_DecodeEscape function in stringobject.c. By sending a specially-crafted request, a remote attacker could overflow a buffer and execute arbitrary code on the system.
CVSS Base Score: 9.8
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/135119&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

IBM RackSwitch G8264

|

7.9

—|—

IBM RackSwitch G8264

|

7.11

Remediation/Fixes

Firmware fix versions are available on Fix Central: http://www.ibm.com/support/fixcentral/

Product

|

Fix Version

—|—

IBM RackSwitch G8264
(G8264_Image_7.9.23.0)

|

7.9.23.0

IBM RackSwitch G8264
(G8264_Image_7.11.13.0)

|

7.11.13.0

Workarounds and Mitigations

None