Security Bulletin: Vulnerability with snappy-java affect IBM Cloud Object Storage Systems (Oc2023v1)

Summary Vulnerability with snappy-java CVE-2023-43642 This vulnerability have been addressed in the latest ClevOS releases Vulnerability Details CVEID:CVE-2023-43642 DESCRIPTION: snappy-java is vulnerable to a denial of service, caused by missing upper bound check on chunk length. By sending a...

Hotfix to Improve Handling of Self-Signed Certificates Used By On-Prem Object Storage with IAM/STS Endpoints, Agent, VM jobs, and Cloud Connect

Article Applicability The hotfix discussed in this article is only necessary when using an on-prem object storage appliance that utilizes self-signed certificates, and you are being affected in the ways described in the Resolved Issues section. If you are not experiencing the errors listed in thi...

Pure Storage FlashBlade Security Vulnerability

Pure Storage FlashBlade is a consolidated storage platform for file and object workloads from U.S.-based Pure Storage. A security vulnerability exists in FlashBlade Purity, which stems from a flaw in FlashBlade Purity that could affect the availability of the system's data access and replication...

Virtuozzo Hybrid Infrastructure 5.4 Update 4 Hotfix 1 (5.4.4-119)

This update provides important stability fixes for the core storage, object storage, and compute services. Vulnerability id: VSTOR-74982 Fixed the customization of S3 URLs with CNAME records. Vulnerability id: VSTOR-75137, VSTOR-75225 Fixed storage and metadata service issues related to incorrect...

Security Bulletin: Vulnerability with Certifi affect IBM Cloud Object Storage Systems (Sept2023v3)

Summary Vulnerability with Certifi CVE-2023-37920 This vulnerability have been addressed in the latest ClevOS releases Vulnerability Details CVEID:CVE-2023-37920 DESCRIPTION: An unspecified error with the removal of e-Tugra root certificate in Certifi has an unknown impact and attack vector. CVSS...

Security Bulletin: Vulnerability with Python affect IBM Cloud Object Storage Systems (Sept2023v2)

Summary Vulnerability with Python CVE-2023-40217 This vulnerability have been addressed in the latest ClevOS releases Vulnerability Details CVEID:CVE-2023-40217 DESCRIPTION: Python could allow a remote attacker to bypass security restrictions, caused by a race condition in the SSLSocket module...

Security Bulletin: Vulnerability with kernel , OpenJDK jna-platform affect IBM Cloud Object Storage Systems (Sept2023)

Summary Vulnerability with kernel CVE-2023-2269, CVE-2023-34256, OpenJDK CVE-2023-22041 CVE-2023-22043 CVE-2023-22044 CVE-2023-22006 CVE-2023-22045 CVE-2023-22036 CVE-2023-22049, jna-platform 240628 This vulnerability have been addressed in the latest ClevOS releases Vulnerability Details...

Security Bulletin: Vulnerability with bcprov-jdk affect IBM Cloud Object Storage Systems (Sept2023)

Summary Vulnerability with bcprov-jdk CVE-2023-33201 This vulnerability have been addressed in the latest ClevOS releases Vulnerability Details CVEID:CVE-2023-33201 DESCRIPTION: The Bouncy Castle Crypto Package For Java bc-java could allow a remote attacker to obtain sensitive information, caused...

Virtuozzo Hybrid Infrastructure 5.4 Update 4 (5.4.4-112)

This update delivers a new feature for the compute service, performance optimization for the object storage, as well as stability, security, and performance improvements. Vulnerability id: VSTOR-74916 VMs with Windows Server 2019, Windows Server 2022, and Windows 10 fail to boot after installatio...

Virtuozzo Hybrid Infrastructure 5.4 Update 3 Hotfix 2 (5.4.3-103)

This update provides important fixes for the core storage and object storage services. Vulnerability id: VSTOR-73165 After updating an expired license, some virtual machines continue to be stuck. Vulnerability id: VSTOR-72936 The MDS service may get overloaded by clients. Vulnerability id:...

Information Disclosure

gitlab is vulnerable to Information Disclosure. The vulnerability exists in the SendEntry of the library, which allows an attacker to gain sensitive information through the URL of artifacts stored in object storage with a temporary availability via Rails logs...

CVE-2023-26442

In case Cacheservice was configured to use a sproxyd object-storage backend, it would follow HTTP redirects issued by that backend. An attacker with access to a local or restricted network with the capability to intercept and replay HTTP requests to sproxyd or who is in control of the sproxyd...

Increase in API Calls when Performing Direct Backups to Immutable Object Storage

Article Applicability This article was created to address high API usage observed with Veeam Backup & Replication 12.x. Starting in Veeam Backup & Replication 13, improvements were made to the handling of immutability-related API calls, which will significantly reduce the number of API calls that...

CVE-2021-39014 IBM Cloud Object Storage System cross-site scripting

IBM Cloud Object System 3.15.8.97 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 213650...

CVE-2021-39014 IBM Cloud Object Storage System cross-site scripting

IBM Cloud Object System 3.15.8.97 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 213650...

Code injection

Minio Console is the UI for MinIO Object Storage. Unicode RIGHT-TO-LEFT OVERRIDE characters can be used to mask the original filename. This issue has been patched in version 0.28.0...

CVE-2023-33955 Minio console object names with RIGHT-TO-LEFT OVERRIDE unicode character can be exploited

Minio Console is the UI for MinIO Object Storage. Unicode RIGHT-TO-LEFT OVERRIDE characters can be used to mask the original filename. This issue has been patched in version 0.28.0...

CVE-2023-33955 Minio console object names with RIGHT-TO-LEFT OVERRIDE unicode character can be exploited

Minio Console is the UI for MinIO Object Storage. Unicode RIGHT-TO-LEFT OVERRIDE characters can be used to mask the original filename. This issue has been patched in version 0.28.0...

Unable to Add Object Storage With Versioning to Veeam Backup for Microsoft 365

Challenge When adding an Object Storage Repository, the following error occurs: The selected bucket supports blob versioning. Select a bucket with disabled blob versioning. Cause This issue occurs because the cloud storage has Versioning enabled. Starting with Veeam Backup for Microsoft 365 v7,...

Virtuozzo Hybrid Infrastructure 5.4 Update 2 (5.4.2-58)

In this release, Virtuozzo Hybrid Infrastructure provides a range of new features that cover the compute services, core and object storage, integrations, monitoring and alerts. Additionally, this release delivers stability improvements and addresses issues found in previous releases. Vulnerabilit...