Security Bulletin: glibc vulnerability may affect IBM Storage Scale System (CVE-2023-4806)

Summary IBM Storage Scale System is shipped with GNU glibc, for which a fix is available for a security vulnerability. Vulnerability Details CVEID:CVE-2023-4806 DESCRIPTION: GNU glibc is vulnerable to a denial of service, caused by a use-after-free flaw in the getaddrinfo function. By sending a...

Security Bulletin: Multiple security vulnerabilities in systemd may affect IBM Storage Scale System

Summary Multiple security vulnerabilities has been identified in IBM Storage Scale System where systemd is vulnerable to denial of service. A fix for these vulnerabilities is available. Vulnerability Details CVEID:CVE-2022-4415 DESCRIPTION: systemd could allow a local authenticated attacker to...

Security Bulletin: Multiple Linux Kernel vulnerabilities may affect IBM Storage Scale System

Summary There are vulnerabilities in the Linux kernel, used by IBM Storage Scale System, which could allow a denial of service. Fixes for these vulnerabilities are available. Vulnerability Details CVEID:CVE-2023-1195 DESCRIPTION: Linux Kernel is vulnerable to a denial of service, caused by a...

Security Bulletin: Multiple vulnerabilities have been identified in Golang Go used with IBM Storage Scale Data Access Services (DAS) which can cause denial of service.

Summary Multiple security vulnerabilities have been identified in Golang Go used with IBM Storage Scale Data Access Services DAS which can cause denial of service. A fix for this vulnerability is available. Vulnerability Details CVEID:CVE-2023-39325 DESCRIPTION: Golang Go is vulnerable to a denia...

Security Bulletin: Multiple vulnerabilities in IBM Storage Scale Container Native could allow access to container outside the current namespace

Summary Multipe security vulnerabilities have been identified in IBM Storage Scale Container Native that could allow access to container outside the current namespace. A fix for these vulnerabilities is available. Vulnerability Details CVEID:CVE-2022-41738 DESCRIPTION: IBM Spectrum Scale could...

Security Bulletin: Linux Kernel vulnerability may affect IBM Elastic Storage System (CVE-2023-28466)

Summary There is a vulnerability in the Linux kernel, used by IBM Elastic Storage System, which could allow a denial of service. Vulnerability Details CVEID:CVE-2023-28466 DESCRIPTION: Linux Kernel is vulnerable to a denial of service, caused by the lack of a locksock call in dotlsgetsockopt in...

Security Bulletin: IBM Storage Protect for Virtual Environments is vulnerable to arbitrary code execution, sensitive information disclosure, and denial of service due to CVEs in Apache Velocity, Apache Jena, and XStream (woodstox)

Summary IBM Storage Protect for Virtual Environments Data Protection for VMware and Data Protection for Hyper-V can be affected by security flaws in Apache Velocity, Apache Jena, and XStream woodstox. The flaws can lead to arbitrary code execution, sensitive information disclosure, and denial of...

Security Bulletin: IBM Storage Fusion may be vulnerable to Injection, Regular Expression Denial of Service (ReDoS), and Arbitrary Code Execution and via use of postcss, semver, babel-traverse (CVE-2023-45133, CVE-2022-25883, CVE-2023-44270)

Summary JavaScript libraries postcss, semver, and babel-traverse are used by IBM Storage Fusion's Web Interface. Vulnerabilities in these libraries could lead to Denial of Service and Arbitrary Code Injection as described the the CVEs listed in the "Vulnerability Details" section. Vulnerability...

Security Bulletin: IBM Storage Fusion may be vulnerable to Denial of Service via use of golang.org/x/net, x/crypto, and x/text (CVE-2022-30633, CVE-2022-27664, CVE-2022-28131, CVE-2022-41721, CVE-2021-43565, CVE-2022-27191, CVE-2022-32149)

Summary Golang's x/net, x/crypto and x/text are used by IBM Storage Fusion for networking, cryptography and internationalization. Vulnerabilities in these libraries include Inconsistent Interpretation of HTTP Requests, Uncontrolled Recursion, and Missing Release of Resource that could lead to a...

Security Bulletin: IBM Storage Fusion may be vulnerable to Denial of Service via use of openshift/machine-api-operator, openshift/machine-config-operator (CVE-2020-28851, CVE-2020-28852, CVE-2021-44716)

Summary OpenShift's machine-api-operator and machine-config-operator are used by IBM Storage Fusion to interact with the OpenShift platform, operators, and custom resource definitions. Vulnerabilities in these libraries include an improper validation of array index and possible uncontrolled...

Security Bulletin: A vulnerability in Samba affects IBM Storage Scale SMB protocol access method (CVE-2022-2127)

Summary A Samba vulnerability affects IBM Storage Scale SMB protocol access method that could allow a remote authenticated attacker to execute arbitrary code or denial of service on the system. Vulnerability Details CVEID:CVE-2022-2127 DESCRIPTION: Samba is vulnerable to a denial of service, caus...

Security Bulletin: Multiple vulnerabilities in samba affects IBM Storage Scale SMB protocol access method

Summary Multiple samba vulnerabilities affects IBM Storage Scale SMB protocol access method that could allow denial of the service on the system. The fix for this is available. Vulnerability Details CVEID:CVE-2023-34967 DESCRIPTION: Samba is vulnerable to a denial of service, caused by a type...

Security Bulletin: Vulnerabilities in urllib3, Python and Tornado can affect IBM Storage Protect Plus Microsoft File Systems Backup and Restore [CVE-2023-43804,CVE-2023-40217,263690]

Summary IBM Storage Protect Plus Microsoft File Systems Backup and Restore can be affected by vulnerabilities in urllib3, Python and Tornado which include obtaining sensitive information, bypass security restrictions and bypass web application firewall protection, and conduct XSS attacks, as...

Security Bulletin: IBM Storage Ceph is vulnerable to Cross-site Scripting in Grafana (CVE-2023-22462)

Summary Grafana is used by IBM Storage Ceph as part of the dashboard to monitor the stats for each cluster. CVE-2023-22462 Vulnerability Details CVEID: CVE-2023-22462 DESCRIPTION: Grafana is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the Text plugi...

Security Bulletin: IBM Storage Ceph is vulnerable to Improper Input Validation in Curl (CVE-2022-35252)

Summary Curl is used by IBM Storage Ceph as part of RHEL, the base operating system. CVE-2022-35252 Vulnerability Details CVEID: CVE-2022-35252 DESCRIPTION: cURL libcurl is vulnerable to a denial of service, caused by a flaw when cookies contain control codes are later sent back to an HTTPS serve...

Security Bulletin: IBM Storage Ceph is vulnerable to Cross-site Scripting in Grafana (CVE-2022-21702 )

Summary Grafana is used by IBM Storage Ceph as part of the dashboard to monitor the stats for each cluster. CVE-2022-21702 Vulnerability Details CVEID: CVE-2022-21702 DESCRIPTION: Grafana is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the Grafana...

Security Bulletin: IBM Storage Ceph is vulnerable to Cross-site Scripting in Grafana (CVE-2023-0594)

Summary Grafana is used by IBM Storage Ceph as part of the dashboard to monitor the stats for each cluster. CVE-2023-0594 Vulnerability Details CVEID: CVE-2023-0594 DESCRIPTION: Grafana is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the TraceView...

Security Bulletin: IBM Storage Ceph is vulnerable to Cross-Site Request Forgery in Grafana (CVE-2022-21703)

Summary Grafana is used by IBM Storage Ceph as part of the dashboard to monitor the stats for each cluster. CVE-2022-21703 Vulnerability Details CVEID: CVE-2022-21703 DESCRIPTION: Grafana is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By...

Security Bulletin: IBM Storage Ceph is vulnerable via use of insufficiently random values and via exposure of sensitive information to an unauthorized actor in Golang (CVE-2022-30629)

Summary Golang is used by IBM Storage Ceph as part of RGW and in assorted other locations. CVE-2022-30629 Vulnerability Details CVEID: CVE-2022-30629 DESCRIPTION: Golang Go could allow a remote attacker to obtain sensitive information, caused by an issue with session tickets generated by crypto/t...

Security Bulletin: IBM Storage Ceph is vulnerable to a path traversal vulnerablity in Moment.js (CVE-2022-24785)

Summary Moment.js is used within the IBM Storage Ceph Dashboard and in assorted other locations. CVE-2022-24785 Vulnerability Details CVEID: CVE-2022-24785 DESCRIPTION: Moment.js could allow a remote attacker to traverse directories on the system, caused by improper validation of user supplied...