Skip to main content
Migration Notice
We're migrating documentation from the old portal into this one. Some things may look a little different or out of place in the meantime — we know, and we're working to get it right. If something's unclear or doesn't look right, let us know.
Version: 2.15.0

Appliance and Security Advisories (All Products)

Introduction​

Data Security, AirGap, and Disaster Recovery for Dell all run on the same underlying Superna Eyeglass appliance, and share the same ECA (Eyeglass Clustered Agent) node family — including the ECA nodes used by Ransomware Defender and Easy Auditor, and the Vault Agent nodes used by AirGap. Because of this shared foundation, some technical advisories apply regardless of which of the three editions you have deployed. This page collects those cross-product appliance and security advisories in one place.

Advisories that are specific to a single product's failover, detection, or replication behavior are documented on that product's own Technical Advisories page instead — see Disaster Recovery Technical Advisories for DR-specific failover and replication advisories.

tip

The appliance defaults to weekly automatic critical patches and security updates when it has internet access. Confirm your appliance OS version and patch level regularly, and prioritize the OS upgrade recommendations below if your appliance is running an older openSUSE release.

Log4j Hardening (Eyeglass Appliance and ECA/Vault Agent Nodes)​

The Log4j vulnerabilities (CVE-2021-44228, CVE-2021-45046, CVE-2021-4104) affect the Java-based components used across all three editions: the core Eyeglass appliance, and the ECA/Vault Agent nodes used by Ransomware Defender, Easy Auditor, Performance Auditor, and AirGap (including Golden Copy and Search & Recover).

Eyeglass Appliance​

Release 2.5.8 build 21330 includes the patched log4j 2.17 version. Scan results using the "Log4Shell Vulnerability Ecosystem" template show no exposure on the Eyeglass appliance for 2.5.7.1 and 2.5.8 releases with no modifications, since the appliance does not expose ports that can be used to exploit this CVE via a port scan.

If remediation is still required on an older build, run the following on the Eyeglass appliance:

sudo -s
find /opt/superna -name '*.jar' | xargs -I {} zip -q -d {} org/apache/logging/log4j/core/lookup/JndiLookup.class
find /opt/superna -name '*.jar' | xargs -I {} zip -q -d {} org/apache/log4j/net/JMSAppender.class
systemctl restart sca

Run the find/zip commands a second time; if the output reads zip error: Nothing to do! on the second pass, the patch has been applied successfully.

ECA Nodes (Ransomware Defender, Easy Auditor, Performance Auditor)​

ECA 2.5.7.x releases with no modifications, and ECA 2.5.8 (which has an updated log4j), both pass scans with no exposure. If remediation is required on an affected build, contact Superna Support for the correct docker-compose.overrides.yml override file for your ECA version, then apply it on ECA node 1 as the ecaadmin user and restart the cluster with ecactl cluster down / ecactl cluster up.

Golden Copy and Search & Recover Nodes​

Golden Copy 1.1.6 and Search & Recover 1.1.5 releases, with no modifications, pass scans with no exposure. The same override-file remediation pattern used for ECA nodes applies to these products' nodes if you are running an affected build — contact Superna Support for the correct override file for your release.

note

CVE-2021-45046 (log4j 2.16) does not apply to any Superna product, since the affected MDC function is not used.

OneFS 9.3+ API Session Bug Affecting Golden Copy and Search & Recover​

OneFS 9.3 and later changed session authentication behavior in a way that is not backwards-compatible with earlier session authentication, causing authentication sessions — and the API calls that depend on them — to fail. This affects the AirGap-adjacent Golden Copy and Search & Recover products specifically.

Workaround: as the root user on the affected PowerScale cluster, increase the session timeout values:

isi_gconfig -t web-config session_absolute_timeout=2160000
isi_gconfig -t web-config session_inactive_timeout=2160000

An OneFS patch is available in OneFS 9.4.0.14 RUP and OneFS 9.5.0.3 RUP and later.

Eyeglass REST API Unauthenticated Access​

Affected an API token authentication check on Eyeglass DR, Ransomware Defender, Easy Auditor, and Performance Auditor builds from 2.5.9-22219 through 2.5.11-23110: a request using a token that did not match any authorized token could still reach REST API routes. There was no risk to data on PowerScale or to any product configuration. Resolved in build 2.5.11-23111 and later — upgrade if you are running an affected build.

Appliance OS Vulnerabilities (OpenSUSE)​

These advisories apply to the underlying OpenSUSE OS used by the Eyeglass appliance across all three editions:

  • Vulnerable OpenSSH Version (CVE-2024-6409): identified on appliance OpenSUSE versions older than 15.4. Upgrade the appliance OS to 15.5 or later.
  • Docker AuthZ Plugin Regression (CVE-2024-41110): applies only to environments using the Docker AuthZ plugin. Superna products do not use this plugin and are not affected.
  • Grafana Vulnerabilities (CVE-2024-1442, CVE-2024-1313): per Grafana's own advisories, these do not affect Grafana version 11, which is the version used in current Superna products.
  • xz/liblzma Supply Chain Vulnerability (CVE-2024-3094): Superna appliances use packages from the openSUSE Leap distribution, which was not affected by this supply-chain compromise.
  • openSUSE Security Vulnerabilities (CVE-2024-21626, CVE-2024-23651, CVE-2024-23652, CVE-2024-23653): affect openSUSE 15.4 and earlier. Upgrade the appliance OS to 15.5 or later and apply current OS patches.

See Also​