Security Bulletin: This Power Hardware Management Console (HMC) update is being released to address Common Vulnerabilities and Exposures issue numbers CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, and CVE-2019-11091 (known as MDS).

Summary In response to recently reported security vulnerabilities, this Power HMC Security Bulletin is released to address Common Vulnerabilities and Exposures issue numbers CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, and CVE-2019-11091. Vulnerability Details CVEID: CVE-2018-12126 CVEID:...

Security Bulletin: Vulnerabilities in Glibc affect Power Hardware Management Console ( CVE-2017-15670, CVE-2017-12132, CVE-2015-5180, CVE-2014-9402)

Summary Glibc is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVEs Vulnerability Details Relevant CVE Information: CVEID: CVE-2017-15670 DESCRIPTION: GNU C Library is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by the glob...

Security Bulletin: Vulnerabilities in Kerberos affect Power Hardware Management Console (CVE-2017-11368, CVE-2017-7562)

Summary Kerberos is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVEs Vulnerability Details CVEID: CVE-2017-11368 DESCRIPTION: MIT Kerberos 5 is vulnerable to a denial of service, caused by a KDC assertion failure. By sending a specially-crafted request, a remot...

Security Bulletin: Vulnerability in OpenSSH affects Power Hardware Management Console (CVE-2017-15906)

Summary OpenSSH is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVE Vulnerability Details CVEID: CVE-2017-15906 DESCRIPTION: OpenSSH is vulnerable to a denial of service, caused by an error in the processopen function when in read-only mode. A remote authenticat...

Security Bulletin: Vulnerability in systemd affects Power Hardware Management Console (CVE-2019-6454)

Summary systemd is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVE Vulnerability Details CVEID: CVE-2019-6454 DESCRIPTION: The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides...

Security Bulletin: Vulnerability in OpenSSL affects Power Hardware Management Console

Summary Linux OpenSSL is vulnerable to a denial of service, affected by CVES : CVE-2017-3735, CVE-2018-0732, CVE-2018-0739. Vulnerability Details VEID: CVE-2018-0732 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by the sending of a very large prime value to the client by a...

Security Bulletin: Vulnerability in Kernel affects Power Hardware Management Console (CVE-2018-5391)

Summary Linux Kernel is vulnerable to a denial of service, caused by the improper handling of the reassembly of fragmented IPv4 and IPv6 packets by the IP implementation. By sending specially crafted IP fragments with random offsets, a remote attacker could exploit this vulnerability to exhaust a...

Security Bulletin: Vulnerability in kernel affects Power Hardware Management Console (CVE-2018-14633)

Summary Power Hardware Management Console is affected by security vulnerabilities in the Linux Kernel. Power Hardware Management Console has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2018-14633 DESCRIPTION: A security flaw was found in the chapservercomputemd5 function in the...

Security Bulletin: Vulnerabilities in OpenSSL affect Power Hardware Management Console (CVE-2017-3737, CVE-2017-3736)

Summary OpenSSL is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVEs Vulnerability Details CVEID: CVE-2017-3737 DESCRIPTION: OpenSSL could allow a remote attacker to bypass security restrictions, caused by a flaw in the "error state" mechanism when directly...

CVE-2021-29707

IBM HMC Hardware Management Console V9.1.910.0 and V9.2.950.0 could allow a local user to escalate their privileges to root access on a restricted shell. IBM X-Force ID: 200879...

Code injection

IBM HMC Hardware Management Console V9.1.910.0 and V9.2.950.0 could allow a local user to escalate their privileges to root access on a restricted shell. IBM X-Force ID: 200879...

CVE-2021-29707

CVE-2021-29707 affects IBM HMC (Power Hardware Management Console) V9.1.910.0 and V9.2.950.0, where a local user can escalate privileges to root on a restricted shell. The IBM bulletin lists affected versions and provides fixes: Power HMC V9.1.940.0 SP2 (MB04287, MH01896) for PPC and V9.1.940.0 S...

CVE-2021-29707

IBM HMC Hardware Management Console V9.1.910.0 and V9.2.950.0 could allow a local user to escalate their privileges to root access on a restricted shell. IBM X-Force ID: 200879...

CVE-2021-29707: Undefined Security Weakness

IBM HMC Hardware Management Console V9.1.910.0 and V9.2.950.0 could allow a local user to escalate their privileges to root access on a restricted shell. IBM X-Force ID: 200879...

PT-2021-18422

Name of the Vulnerable Software and Affected Versions IBM HMC Hardware Management Console versions 9.1.910.0 through 9.2.950.0 Description The issue allows a local user to escalate their privileges to root access on a restricted shell. Recommendations For versions 9.1.910.0 and 9.2.950.0, update ...

CentOS: Security Advisory for fence-agents-aliyun (CESA-2020:5003)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Security Bulletin: Vulnerabilities have been identified in OpenSSL and the Kernel shipped with the DS8000 Hardware Management Console (HMC)

Summary The updates indicated below have been released to address the following vulnerabilities: OpenSSL vulnerabilites - CVE-2019-1559, CVE-2018-0734 Linux Kernel vulnerabilites - CVE-2019-11477, CVE-2019-11478 and CVE-2019-11479 Vulnerability Details CVEID: CVE-2019-1559 DESCRIPTION: If an...

Code injection

SAP Commerce Cloud Mediaconversion Extension, versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, allows an authenticated Backoffice/HMC user to inject code that can be executed by the application, leading to Code Injection. An attacker could thereby control the behavior of the application...

CVE-2019-0343: Improper Control of Generation of Code

SAP Commerce Cloud Mediaconversion Extension, versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, allows an authenticated Backoffice/HMC user to inject code that can be executed by the application, leading to Code Injection. An attacker could thereby control the behavior of the application...

PT-2019-4195

Name of the Vulnerable Software and Affected Versions SAP Commerce Cloud Mediaconversion Extension versions 6.4 through 6.7, 1808, 1811, 1905 Description The issue is related to errors in code generation management in the Mediaconversion component of the SAP Commerce Cloud e-commerce platform. It...