Improper Neutralization of Special Elements in Output Used by a Downstream Component in IBM Corporation products - CVE-2021-29873

Vulnerability identifier: #VU66528

CSH Severity: Medium

CVSS v4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-29873

CWE-ID: CWE-74

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to gain access to potentially sensitive information and perform a denial of service attack.

The vulnerability exists due to restricted shell escape. A remote user can gain unauthorized access to sensitive information on the system and perform a denial of service attack.

FlashSystem 900 9840-AE1 and 9843-AE1
FlashSystem 900 9840-AE2 and 9843-AE2
FlashSystem 900 9840-AE3 and 9843-AE3
SAN Volume Controller and Storwize Family
IBM Cloud Pak System
IBM FlashSystem 7200
IBM Spectrum Virtualize for Public Cloud
IBM Spectrum Virtualize Software
IBM FlashSystem 5000
IBM FlashSystem 5200
IBM FlashSystem 9200
IBM FlashSystem 9100 Family
IBM FlashSystem V9000
IBM Storwize V3500
IBM Storwize V3700
IBM Storwize V5100
IBM Storwize V5000
IBM Storwize V7000
IBM SAN Volume Controller

Install updates from vendor's website.

FlashSystem 900 9840-AE1 and 9843-AE1 - addressed in versions 1.5.2.10, 1.6.1.4
FlashSystem 900 9840-AE2 and 9843-AE2 - addressed in versions 1.5.2.10, 1.6.1.4
FlashSystem 900 9840-AE3 and 9843-AE3 - addressed in versions 1.5.2.10, 1.6.1.4
IBM Cloud Pak System - update to 2.3.3.5
SAN Volume Controller and Storwize Family - addressed in versions 7.8.1.14, 8.2.1.14, 8.3.1.6, 8.4.0.5, 8.4.2.0
IBM FlashSystem 7200 - update to 8.4.2.0
IBM Spectrum Virtualize for Public Cloud - update to 8.4.2.0
IBM Spectrum Virtualize Software - update to 8.4.2.0
IBM FlashSystem 5000 - update to 8.4.2.0
IBM FlashSystem 5200 - update to 8.4.2.0
IBM FlashSystem 9200 - update to 8.4.2.0
IBM FlashSystem 9100 Family - update to 8.4.2.0
IBM FlashSystem V9000 - update to 8.4.2.0
IBM Storwize V3500 - update to 8.4.2.0
IBM Storwize V3700 - update to 8.4.2.0
IBM Storwize V5100 - update to 8.4.2.0
IBM Storwize V5000 - update to 8.4.2.0
IBM Storwize V7000 - update to 8.4.2.0
IBM SAN Volume Controller - update to 8.4.2.0

• https://www.ibm.com/support/pages/node/6497111
• https://www.ibm.com/support/pages/node/6507091
• https://exchange.xforce.ibmcloud.com/vulnerabilities/206229

• Restricted shell escape in IBM FlashSystem 900
• Information disclosure in IBM Cloud Pak System
• Restricted shell escape in IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem V9000 products
• Restricted shell escape in IBM SAN Volume Controller and Storwize Family