SB2025052088 - Multiple vulnerabilities in Dell PowerScale OneFS

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Buffer Underwrite ('Buffer Underflow') (CVE-ID: CVE-2024-45490)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to a boundary error in xmlparse.c when handling negative length for XML_ParseBuffer. A remote attacker can pass specially crafted input to the application, trigger buffer underflow and execute arbitrary code on the system.

2) Command Injection (CVE-ID: CVE-2024-6923)

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to insufficient validation of newlines for email headers when serializing an email message. A remote attacker can inject arbitrary headers into serialized email messages.

3) Improper Certificate Validation (CVE-ID: CVE-2024-39689)

The vulnerability allows a remote attacker to modify data on the system.

The vulnerability exists due to Certifi python-certifi provide weaker than expected security, caused by the use of GLOBALTRUST root certificate. A remote attacker can trigger the vulnerability to launch further attacks on the system.

Remediation

Install update from vendor's website.

References

• https://www.dell.com/support/kbdoc/nl-nl/000289682/dsa-2025-082-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities