BSA-2018-525

Security Advisory ID : BSA-2018-525 Component : Fabric OS Web GUI Revision : 1.0: Initial XSS vulnerabilities in the web-based management interface of Brocade Fibre Channel SAN products running Brocade Fabric OS FOS could allow remote unauthenticated attackers to execute arbitrary script code in...

BSA-2017-204

Security Advisory ID : BSA-2017-204 Component : Linux Kernel Revision : 1.0: Interim Xen and the Linux kernel through 4.5.x do not properly suppresshugetlbfssupport in x86 PV guests, which allows local PV guest OS users to cause a denial of service guest OS crash by attempting to access...

Checking excessively long DSA keys or parameters may be very slow

OpenSSL contains an unbounded computation flaw when performing checks on excessively large DSA keys or parameters, which could lead to a denial-of-service DoS attack. The OpenSSL pkey, pkeyparam command line apps, and FIPS providers are affected...

The encryption key is stored in the DR log files (CVE-2024-29957).

When Brocade SANnav before v2.3.1 and v2.3.0a servers are configured in Disaster Recovery mode, the encryption key is stored in the DR log files. This could provide attackers with an additional, less-protected path to acquiring the encryption key.Products Affected...

PostgreSQL vulnerability in SANnav 2.2.0.2

A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait for an administrator to create or update an affected extension in that schema, and the ability to lure or wait for a victim to use the objec...

BSA-2020-1082

Security Advisory ID : BSA-2020-1082 Component : REST API Revision : 2.0 Multiple buffer overflow vulnerabilities in REST API in Brocade Fabric OS versions v8.2.1 through v8.2.1d, and 8.2.2 versions before v8.2.2c could allow remote unauthenticated attackers to perform various attacks. Note:...

BSA-2020-1076

Security Advisory ID : BSA-2020-1076 Component : Database credentials Revision : 1.1 Brocade SANnav versions before v2.1.0, contain a Plaintext Password Storage vulnerability. Database credentials are stored in plaintext in a configuration file. An unauthenticated malicious user with access to th...

BSA-2018-698

Security Advisory ID : BSA-2018-698 Component : OpenSSH Revision : 2.0: Final OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c...

BSA-2018-636

Security Advisory ID : BSA-2018-636 Component : OpenSSL Revision : 2.0: Final The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process coul...

BSA-2017-264

Security Advisory ID : BSA-2017-264 Component : OpenSSL Revision : 1.0: Interim During a renegotiation handshake if the Encrypt-Then-Mac extension is negotiated where it was not in the original handshake or vice-versa then this can cause OpenSSL to crash dependent onciphersuite. Both clients and...

BSA-2017-207

Security Advisory ID : BSA-2017-207 Component : OpenSSL Revision : 1.0: Interim Severity: Low-There is a carry propagating bug in the Broadwell-specific Montgomerymultiplication procedure that handles input lengths divisible by, butlonger than 256 bits. Analysis suggests that attacks against RSA,...

CVE-2023-31926 - Arbitrary File Overwrite using less command

System files could be overwritten using the less command in Brocade Fabric OS before Brocade Fabric OS v9.1.1c and v9.2.0...

Flaw in glib could leak content from files owned by privileged users to unprivileged ones.

A flaw was found in glib before version 2.63.6. Due to random charset alias, pkexec can leak content from files owned by privileged users to unprivileged ones under the right condition...

CVE-2022-28169 - Brocade Fabric OS Privilege Escalation Vulnerability (BSA-2022-2075)

Security Advisory ID : BSA-2022-2075 Component : Webtools Revision : 3.1 Brocade Webtools in Brocade Fabric OS versions before Brocade Fabric OS versions v9.1.1, v9.0.1e, and v8.2.3c could allow a low privilege webtools user to gain elevated admin rights, or privileges, beyond what is intended or...

BSA-2020-950

Security Advisory ID : BSA-2020-950 Component : REST API Revision : 1.0 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services IIS 7.0, modssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier...

BSA-2017-208

Security Advisory ID : BSA-2017-208 Component : FOS Revision : 2.0: Interim A privilege escalation vulnerability in BrocadeFibreChannel SAN products running Brocade Fabric OS FOS releases earlier than v7.4.1d and v8.0.1b could allow an authenticated, attacker to elevate the privileges of user...

BSA-2017-255

Security Advisory ID : BSA-2017-255 Component : OpenSSH Revision : 2.0: Final Thekbdintnextdevicefunction in auth2-chall.c insshdinOpenSSHthrough 6.9 does not properly restrict the processing of keyboard-interactive devices within a single connection, which makes it easier for remote attackers to...

BSA-2017-244

Security Advisory ID : BSA-2017-244 Component : SNMP Revision : 2.0: Interim An SNMP community name is the default e.g. public, null, or missing. Affected Products Product| Current Assessment ---|--- Brocade Virtual Web Application Firewall| Impacted: Make sure SNMP is not enabled...

BSA-2017-221

Security Advisory ID : BSA-2017-221 Component : Low bandwidth ICMP attack Revision : 1.0: Interim Blacknurseis a low bandwidth ICMP attack that is capable of doing denial of service towell knownfirewalls.MostICMP attacks that we see are based on ICMP Type 8 Code 0 also called a ping flood...

BSA-2017-220

Security Advisory ID : BSA-2017-220 Component : ntp Revision : 1.0: Interim The broadcast mode of NTP is expected to only be used in a trusted network. If the broadcast network is accessible to an attacker, a potentially exploitable denial of service vulnerability inntpd'sbroadcast mode replay...

BSA-2017-179

Security Advisory ID : BSA-2017-179 Component : BNA Revision : 1.0: Final A Directory Traversal Vulnerability in servletSoftwareImageUploadin the Brocade Network Advisor versions released prior to and including 14.0.2 could allow remote attackers to write to arbitrary files, and consequently dele...

BSA-2017-177

Security Advisory ID : BSA-2017-177 Component : BNA Revision : 1.0: Final A Directory Traversal Vulnerability inFileReceiveServletin the Brocade Network Advisor versions released prior to and including 14.0.2 could allow remote attackers to upload malicious file in a section of the file system...

Security update provided in Brocade ASCG3.4.0b Base OS (OVA Deployment) for Rocky Linux Kernel

Security update provided in Brocade ASCG3.4.0b Base OS OVA Deployment for Rocky Linux Kernel CVE-2022-50673 - Linux Kernel 'ext4' Vulnerable to Use-After-Free via Improper Error Handling in 'ext4orphancleanup' CVE-2022-50865 - Linux Kernel Vulnerable to Signed Integer Overflow via Backlog Limit...

Security update provided in Brocade ASCG3.4.0b Base OS (OVA Deployment) for glib2 (CVE-2025-13601), libsoup (CVE-2025-14523, CVE-2026-0719, CVE-2026-1761), libpng (CVE-2025-64720, CVE-2025-65018, CVE-2025-66293),  python-urllib3 (CVE-2025-66418, CVE-2025-66471, CVE-2026-21441), gnupg2 (CVE-2025-68973)

Security update provided in Brocade ASCG3.4.0b Base OS OVA Deployment for glib2 CVE-2025-13601, libsoup CVE-2025-14523, CVE-2026-0719, CVE-2026-1761, libpng CVE-2025-64720, CVE-2025-65018, CVE-2025-66293, python-urllib3 CVE-2025-66418, CVE-2025-66471, CVE-2026-21441, gnupg2 CVE-2025-68973 Product...

Rocky Linux Updates in ASCG 3.3.0

Multiple Rocky Linux updates applied to Brocade ASCG 3.3.0 RockyLinux 8:bzip2 RLSA-2025:0733 bzip2: bzip2: Data integrity error when decompressing with data integrity tests fail. CVE-2019-12900 RockyLinux 8:pam RLSA-2024:10379 pam: libpam: Libpam vulnerable to read hashed password CVE-2024-10041...

close_altfile in filename.c in less before 606 omits shell_quote calls for LESSCLOSE

GNU is vulnerable to command injection due to missing sanitization of filenames when the LESSCLOSE environment variable is set and invoked. This could allow an attacker to execute malicious commands within the privileges of the utility...

A use-after-free vulnerability exists in the Linux kernel's netfilter: nf_tables component

The Linux kernel is vulnerable to memory corruption due to improper error handling within the netfilter functionality. A local attacker could exploit this vulnerability in order to elevate their privileges. A use-after-free vulnerability in the Linux kernel's netfilter: nftables component can be...

By registering a domain for which they control the authoritative nameservers, an attacker could arrange for a compromised container (CVE-2024-29018)

github.com/docker/docker/libnetwork is a package that provides a native Go implementation for connecting containers Affected versions of this package are vulnerable to Improper Control of a Resource Through its Lifetime, allowing DNS requests from internal networks to be forwarded to an external...

Security updates provided in Brocade Fabric OS v9.2.0, v9.1.1c, v8.2.3d

Dear Brocade Customer: This Advisory aims to inform you of Brocade Fabric OS Security updates in Brocade Fabric OS v9.2.0, v9.1.1c, and v8.2.3d. Please review the recently posted security advisories listed here: Updated Security Advisories...

BSA-2021-1493

Security Advisory ID : BSA-2021-1493 Component : CLI Revision : 1.1 A vulnerability in the Brocade Fabric OS before Brocade Fabric OS v9.0.1a, v8.2.3, v8.2.0CBN4,and v7.4.2h could allow an authenticated CLI user to abuse the history command to write arbitrary content to files. Affected Products...

BSA-2020-1084

Security Advisory ID : BSA-2020-1084 Component : Rest API Revision : 2.0 Rest API in Brocade Fabric OS v8.2.1 through v8.2.1d, and 8.2.2 versions before v8.2.2c is vulnerable to multiple instances of reflected input. Note: Brocade Fabric OS versions before v8.2.1 are not affected. Rest API is...

BSA-2017-257

Security Advisory ID : BSA-2017-257 Component : NTP Revision : 1.0: Interim It was discovered thatntpdas a client did not correctly check the originate timestamp in received packets. A remote attacker could use this flaw to send a crafted packet to anntpdclient that would effectively disable...

BSA-2017-227

Security Advisory ID : BSA-2017-227 Component : ntp Revision : 1.0: Interim Bug 2085 described a condition where the root delay was included twice, causing the jitter value to be higher than expected. Due to a misinterpretation of a small-print variable in The Book, the fix for this problem was...

BSA-2016-209

Security Advisory ID : BSA-2016-209 Component : Web UI Revision : 1.0: Final A CSRF vulnerability in Brocade Virtual Traffic Manager versions released prior to and including 11.0, could allow an attacker to trick a logged-in user into making administrative changes on the traffic manager cluster...

BSA-2016-198

Security Advisory ID : BSA-2016-198 Component : curl/libcurl Revision : 2.0: Final Use-after-free vulnerability inlibcurlbefore 7.50.1 allows attackers to control which connection is used or possibly have unspecified other impact via unknown vectors...

Security update provided for multiple Go Open-source programming language

Security update provided for multiple Go Open-source programming language. CVE-2025-22871 Affects: net/http/internal The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjuncti...

Spring Framework DoS (CVE-2024-38808, CVE-2024-38809 and CVE-2024-22262)

The Spring Framework vulnerabilities identified are located within open source components utilized by Brocade SANnav, however none of these vulnerabilities are in the executable code path. As a part of good security practice, the open source component was updated in the Brocade SANnav 3.0.0...

unauthenticated remote code execution vulnerability in React Server Components. React (CVE-2025-55182), Next.js (CVE-2025-66478).

CVE-2025-55182 Description: A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable co...

Privileged escalation via crafted use of portcfg command

A command injection vulnerability in Brocade Fabric OS before 9.2.0c, and 9.2.1 through 9.2.1a on IP extension platforms could allow a local authenticated attacker to perform a privileged escalation via crafted use of the portcfg command. This specific exploitation is only possible on IP Extensio...

Hardcoded TLS keys used by Docker (CVE-2024-29963).

Brocade SANnav OVA before v2.3.1, and v2.3.0a, contain hardcoded TLS keys used by Docker. Brocade SANnav doesn't have access to remote Docker registries, and knowledge of the keys is a minimal risk as SANnav is prevented from communicating with Docker registries VEX code:...

SQL Table names, column names, and SQL queries are collected in DR standby Supportsave (CVE-2024-29968)

An information disclosure vulnerability exists in Brocade SANnav before v2.3.1 and v2.3.0a when Brocade SANnav instances are configured in disaster recovery mode. SQL Table names, column names, and SQL queries are collected in DR standby Supportsave. This could allow authenticated users to access...

An Improper Input Validation vulnerability for the registered case credentials (CVE-2023-5649)

An Improper Input Validation vulnerability for the registered case credentials in Brocade ASCG before v3.0 could allow a local authenticated user to provide invalid inputs like special characters leading to a Denial of Service DoS when collecting “supportsave” from a Brocade Switch...

CVE-2022-33180. Sensitive files export.

Security Advisory ID : BSA-2022-2082 Component : FOS Revision : 1.1 A vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn5 could allow a local authenticated attacker to export out sensitive files with “seccryptocfg”, “configupload”. Affected...

CVE-2022-33179. A vulnerability in Brocade Fabric OS CLI could allow an attacker to break out of restricted shells and escalate privileges

Security Advisory ID : BSA-2022-2079 Component : FOS Revision : 1.1 A vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, and 7.4.2j could allow a local authenticated user to break out of restricted shells with “set context” and escalate privileges. Affecte...

CVE-2022-33185. Several commands in Brocade Fabric OS use unsafe string function to process user input

Security Advisory ID : BSA-2022-2078 Component : FOS Revision : 1.1 Several commands in Brocade Fabric OS before Brocade Fabric OS v.9.0.1e, v9.1.0 use unsafe string functions to process user input. Authenticated local attackers could abuse these vulnerabilities to exploit stack-based buffer...

BSA-2021-1487

Security Advisory ID : BSA-2021-1487 Component : Libarchive Revision : 1.0 libarchive 3.3.2 suffers from an out-of-bounds read within lhareaddatanone in archivereadsupportformatlha.c when extracting a specially crafted lha archive, related to lhacrc16. Affected Products Brocade SANnav versions...

BSA-2021-1485

Security Advisory ID : BSA-2021-1485 Component : Login Response Header Revision : 1.0 Brocade SANNav before version 2.1.1 contains an information disclosure vulnerability. Successful exploitation of internal server information in the initial login response header. Affected Products Brocade SANnav...

BSA-2020-1074

Security Advisory ID : BSA-2020-1074 Component : LDAP injection Revision : 1.0 A vulnerability in Brocade SANnav versions before v2.1.0 could allow a remote authenticated attacker to conduct an LDAP injection. The vulnerability allows a remote attacker to bypass the authentication process. Affect...

BSA-2020-905

Security Advisory ID : BSA-2020-905 Component : authentication Revision : 1.0: Final Brocade Fabric OS Versions before v7.4.2f, v8.2.2a, v8.1.2j and v8.2.1d could expose external passwords, common secrets or authentication keys used between the switch and an external server. When using certain CL...

BSA-2018-540

Security Advisory ID : BSA-2018-540 Component : OpenSSH Revision : 2.0: Final The 1 roamingread and 2 roamingwrite functions in roamingcommon.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2, when certain proxy and forward options are enabled, do not properly maintain connection file...