====================================================================


                             CERT-Renater

                 Note d'Information No. 2018/VULN312
_____________________________________________________________________

DATE                : 03/10/2018

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Cisco HyperFlex Software versions
                                prior to 3.5(1a).

=====================================================================
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-hyperflex-secret
_____________________________________________________________________

Cisco Security Advisory: Cisco HyperFlex Software Static Signing Key
Vulnerability

Advisory ID: cisco-sa-20181003-hyperflex-secret

Revision: 1.0

For Public Release: 2018 October 3 16:00 GMT

Last Updated: 2018 October 3 16:00 GMT

CVE ID(s): CVE-2018-15382

CVSS Score v(3): 8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

+---------------------------------------------------------------------

Summary

=======

A vulnerability in Cisco HyperFlex Software could allow an
unauthenticated, remote attacker to generate valid, signed session
tokens.

The vulnerability is due to a static signing key that is present in all
Cisco HyperFlex systems. An attacker could exploit this vulnerability by
accessing the static signing key from one HyperFlex system and using it
to generate valid, signed session tokens for another HyperFlex system. A
successful exploit could allow the attacker to access the HyperFlex Web
UI of a system for which they are not authorized.

Cisco has released software updates that address this vulnerability.
There are no workarounds that address this vulnerability.

This advisory is available at the following link:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-hyperflex-secret
["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-hyperflex-secret"]

=========================================================
+ CERT-RENATER        | tel : 01-53-94-20-44            +
+ 23/25 Rue Daviel    | fax : 01-53-94-20-41            +
+ 75013 Paris         | email:cert@support.renater.fr   +
=========================================================