Description:

Dell EMC has released a security update to address several vulnerabilities in the following product:

• Dell EMC PowerProtect Data Manager
  • MyBatis 3.4.4
  • Spring Cloud Netflix Zuul2.2.6.RELEASE
  • json-smart 2.3
  • AWS SDK for Node.js v2.596.0
  • css-whatv4.0.0/css-whatv3.4.2
  • einaros/ws 6.2.2
  • engine.io 3.5.0
  • glob-parent 3.1.0
  • normalize_url v4.5.0/ normalize_url3.3.0
  • path-parse 1.0.6
  • PostCSS 7.0.35
  • Socket.IO Parser 3.3.2
  • UAParser.js 0.7.21
  • Apache Commons Compress 1.20
  • Expression Language 3.03.0.3
  • HashiCorp Consul v1.1.0
  • GoLang 1.16
  • libgcrypt20=1.6.1-16.77.1
  • libsystemd0=228-157.30.1
  • libudev1=228-157.30.1
  • systemd-bash-completion=228-157.30.1
  • systemd-sysvinit=228-157.30.1
  • systemd=228-157.30.1
  • udev=228-157.30.1
  • containerd=1.4.4-16.42.1
  • python3-urllib3=1.25.10-3.29.1
  • bind-utils=9.11.22-3.34.1
  • libbind9-161=9.11.22-3.34.1
  • libdns1110=9.11.22-3.34.1
  • libirs161=9.11.22-3.34.1
  • libisc1107=9.11.22-3.34.1
  • libisccc161=9.11.22-3.34.1
  • libisccfg163=9.11.22-3.34.1
  • liblwres161=9.11.22-3.34.1
  • python-bind=9.11.22-3.34.1
  • dhcp-client=4.3.3-10.22.1
  • dhcp=4.3.3-10.22.1
  • libX11-6=1.6.2-12.21.1
  • libX11-data=1.6.2-12.21.1
  • kernel-default=4.12.14-122.83.1
  • libmspack0=0.4-15.10.1
  • glibc-i18ndata=2.22-114.12.1
  • glibc-locale=2.22-114.12.1
  • glibc=2.22-114.12.1
  • libpython3_6m1_0=3.6.13-4.42.1
  • python36-base=3.6.13-4.42.1
  • python36=3.6.13-4.42.1
  • ucode-intel=20210525-3.35.1
  • libpolkit0=0.113-5.21.1
  • polkit=0.113-5.21.1
  • libxml2-2=2.9.4-46.46.1
  • libxml2-tools=2.9.4-46.46.1
  • libhogweed2=2.7.1-13.6.1
  • libnettle4=2.7.1-13.6.1
  • libjpeg8=8.1.2-31.25.1
  • python3-PyYAML=5.3.1-28.4.3
  • postgresql10-server=10.17-4.16.4
  • postgresql10=10.17-4.16.4
  • dbus-1-x11=1.8.22-35.2
  • dbus-1=1.8.22-35.2
  • libdbus-1-3=1.8.22-35.2
  • java-1_8_0-openjdk-headless=1.8.0.292-27.60.1
  • libpq5=13.3-3.9.3
  • curl=7.60.0-11.23.1
  • libcurl4=7.60.0-11.23.1
  • cpio-lang=2.11-36.9.2
  • cpio=2.11-36.9.2
  • libsolv-tools=0.6.37-2.33.1
  • sudo >= 1.8.27-4.15.1

Threats:

Attacker could exploit these vulnerabilities by doing the following:

• Denial of service attack (DoS)
• Sensitive information disclosure

Best practice and Recommendations:

The CERT team encourages users to review Dell EMC security advisory and apply the necessary update:

• https://www.dell.com/support/kbdoc/en-us/000191930/dsa-2021-181-dell-emc-power-protect-data-manager-update-for-multiple-security-vulnerabilities