Vulnerability-Lookup

GHSA-R3MC-836C-4X5X

Vulnerability from github – Published: 2022-05-24 17:16 – Updated: 2022-05-24 17:16

Details

A potential security vulnerability has been identified in the disk drive firmware installers named Supplemental Update / Online ROM Flash Component on HPE servers running Linux. The vulnerable software is included in the HPE Service Pack for ProLiant (SPP) releases 2018.06.0, 2018.09.0, and 2018.11.0. The vulnerable software is the Supplemental Update / Online ROM Flash Component for Linux (x64) software. The installer in this software component could be locally exploited to execute arbitrary code. Drive Models can be found in the Vulnerability Resolution field of the security bulletin. The 2019_03 SPP and Supplemental update / Online ROM Flash Component for Linux (x64) after 2019.03.0 has fixed this issue.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2020-7135"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-04-27T15:15:00Z",
    "severity": "MODERATE"
  },
  "details": "A potential security vulnerability has been identified in the disk drive firmware installers named Supplemental Update / Online ROM Flash Component on HPE servers running Linux. The vulnerable software is included in the HPE Service Pack for ProLiant (SPP) releases 2018.06.0, 2018.09.0, and 2018.11.0. The vulnerable software is the Supplemental Update / Online ROM Flash Component for Linux (x64) software. The installer in this software component could be locally exploited to execute arbitrary code. Drive Models can be found in the Vulnerability Resolution field of the security bulletin. The 2019_03 SPP and Supplemental update / Online ROM Flash Component for Linux (x64) after 2019.03.0 has fixed this issue.",
  "id": "GHSA-r3mc-836c-4x5x",
  "modified": "2022-05-24T17:16:37Z",
  "published": "2022-05-24T17:16:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7135"
    },
    {
      "type": "WEB",
      "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03945en_us"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

CVE-2020-7135 (GCVE-0-2020-7135)

Vulnerability from cvelistv5 – Published: 2020-04-27 14:16 – Updated: 2024-08-04 09:18

Summary

Severity

No CVSS data available.

CWE

local execution of arbitrary code with privilege elevation

Assigner

hpe

References

1 reference

URL	Tags
https://support.hpe.com/hpsc/doc/public/display?d…	x_refsource_CONFIRM

Impacted products

8 products

Vendor	Product	Version
HPE	HPE Service Pack for ProLiant	Affected: 2018.06.0 Affected: 2018.09.0 Affected: 2018.11.0
HPE	HPE Server Solid State Drives	Affected: HPG2
HPE	HPE Server SAS Hard Drives	Affected: HPG2
HPE	HPE Server SATA Hard Drives	Affected: HPG2
HPE	HPE SATA Read Intensive Solid State Drives	Affected: HPG2
HPE	HPE NVMe Mixed Use Solid State Drives	Affected: HPG2
HPE	HPE Business Critical Hard Drives	Affected: HPG2
HPE	HPE Server Enterprise Hard Drives	Affected: HPG2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T09:18:03.037Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03945en_us"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "HPE Service Pack for ProLiant",
          "vendor": "HPE",
          "versions": [
            {
              "status": "affected",
              "version": "2018.06.0"
            },
            {
              "status": "affected",
              "version": "2018.09.0"
            },
            {
              "status": "affected",
              "version": "2018.11.0"
            }
          ]
        },
        {
          "product": "HPE Server Solid State Drives",
          "vendor": "HPE",
          "versions": [
            {
              "status": "affected",
              "version": "HPG2"
            }
          ]
        },
        {
          "product": "HPE Server SAS Hard Drives",
          "vendor": "HPE",
          "versions": [
            {
              "status": "affected",
              "version": "HPG2"
            }
          ]
        },
        {
          "product": "HPE Server SATA Hard Drives",
          "vendor": "HPE",
          "versions": [
            {
              "status": "affected",
              "version": "HPG2"
            }
          ]
        },
        {
          "product": "HPE SATA Read Intensive Solid State Drives",
          "vendor": "HPE",
          "versions": [
            {
              "status": "affected",
              "version": "HPG2"
            }
          ]
        },
        {
          "product": "HPE NVMe Mixed Use Solid State Drives",
          "vendor": "HPE",
          "versions": [
            {
              "status": "affected",
              "version": "HPG2"
            }
          ]
        },
        {
          "product": "HPE Business Critical Hard Drives",
          "vendor": "HPE",
          "versions": [
            {
              "status": "affected",
              "version": "HPG2"
            }
          ]
        },
        {
          "product": "HPE Server Enterprise Hard Drives",
          "vendor": "HPE",
          "versions": [
            {
              "status": "affected",
              "version": "HPG2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A potential security vulnerability has been identified in the disk drive firmware installers named Supplemental Update / Online ROM Flash Component on HPE servers running Linux. The vulnerable software is included in the HPE Service Pack for ProLiant (SPP) releases 2018.06.0, 2018.09.0, and 2018.11.0. The vulnerable software is the Supplemental Update / Online ROM Flash Component for Linux (x64) software. The installer in this software component could be locally exploited to execute arbitrary code. Drive Models can be found in the Vulnerability Resolution field of the security bulletin. The 2019_03 SPP and Supplemental update / Online ROM Flash Component for Linux (x64) after 2019.03.0 has fixed this issue."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "local execution of arbitrary code with privilege elevation",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-04-27T14:16:32.000Z",
        "orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
        "shortName": "hpe"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03945en_us"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-alert@hpe.com",
          "ID": "CVE-2020-7135",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "HPE Service Pack for ProLiant",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "2018.06.0"
                          },
                          {
                            "version_value": "2018.09.0"
                          },
                          {
                            "version_value": "2018.11.0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "HPE Server Solid State Drives",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "HPG2"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "HPE Server SAS Hard Drives",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "HPG2"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "HPE Server SATA Hard Drives",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "HPG2"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "HPE SATA Read Intensive Solid State Drives",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "HPG2"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "HPE NVMe Mixed Use Solid State Drives",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "HPG2"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "HPE Business Critical Hard Drives",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "HPG2"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "HPE Server Enterprise Hard Drives",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "HPG2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "HPE"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A potential security vulnerability has been identified in the disk drive firmware installers named Supplemental Update / Online ROM Flash Component on HPE servers running Linux. The vulnerable software is included in the HPE Service Pack for ProLiant (SPP) releases 2018.06.0, 2018.09.0, and 2018.11.0. The vulnerable software is the Supplemental Update / Online ROM Flash Component for Linux (x64) software. The installer in this software component could be locally exploited to execute arbitrary code. Drive Models can be found in the Vulnerability Resolution field of the security bulletin. The 2019_03 SPP and Supplemental update / Online ROM Flash Component for Linux (x64) after 2019.03.0 has fixed this issue."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "local execution of arbitrary code with privilege elevation"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03945en_us",
              "refsource": "CONFIRM",
              "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03945en_us"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
    "assignerShortName": "hpe",
    "cveId": "CVE-2020-7135",
    "datePublished": "2020-04-27T14:16:32.000Z",
    "dateReserved": "2020-01-16T00:00:00.000Z",
    "dateUpdated": "2024-08-04T09:18:03.037Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-R3MC-836C-4X5X

CVE-2020-7135 (GCVE-0-2020-7135)

Tags

Sightings

Nomenclature