TI-2017-01300 Aliases CVE-2017-1654 GHSA-4pmr-98gg-9wvp

Information disclosure in IBM Spectrum Scale

LOW 19CWE-200Published 2018-03-02 · Updated 2024-09-16

Key facts

Attack vector: Local
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: No fix listed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

IBM Spectrum Scale 4.1.1 and 4.2.0 - 4.2.3 could allow a local unprivileged user access to information located in dump files. User data could be sent to IBM during service engagements. IBM X-Force ID: 133378.

Why it matters now

EPSS 0.00376 31st percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
IBM	Spectrum Scale	4.1.1; 4.2.0; 4.2.1; 4.2.2; 4.2.3	—	No fix listed	CNA

Spectrum Scale VendorIBM Affected 4.1.1; 4.2.0; 4.2.1; 4.2.2; 4.2.3 Fixed in — No fix listed CNA

CPE configurations NVD · 11

CPE	Versions	Role	Vendor
cpe:2.3:a:ibm:spectrum_scale::::::::	4.1.1.0 – 4.1.1.18; 4.2.0.0 – 4.2.0.4; 4.2.1.0 – 4.2.1.2; 4.2.2.0 – 4.2.2.3; 4.2.3.0 – 4.2.3.6	Vulnerable	IBM
cpe:2.3:a:ibm:spectrum_scale:5.0.0.0:::::::*	5.0.0.0	Vulnerable	IBM
cpe:2.3:a:ibm:general_parallel_file_system:4.1.0.0:::::::*	4.1.0.0	Vulnerable	IBM
cpe:2.3:a:ibm:general_parallel_file_system:4.1.0.1:::::::*	4.1.0.1	Vulnerable	IBM
cpe:2.3:a:ibm:general_parallel_file_system:4.1.0.2:::::::*	4.1.0.2	Vulnerable	IBM
cpe:2.3:a:ibm:general_parallel_file_system:4.1.0.3:::::::*	4.1.0.3	Vulnerable	IBM
cpe:2.3:a:ibm:general_parallel_file_system:4.1.0.4:::::::*	4.1.0.4	Vulnerable	IBM
cpe:2.3:a:ibm:general_parallel_file_system:4.1.0.5:::::::*	4.1.0.5	Vulnerable	IBM
cpe:2.3:a:ibm:general_parallel_file_system:4.1.0.6:::::::*	4.1.0.6	Vulnerable	IBM
cpe:2.3:a:ibm:general_parallel_file_system:4.1.0.7:::::::*	4.1.0.7	Vulnerable	IBM

cpe:2.3:a:ibm:spectrum_scale:*:*:*:*:*:*:*:* Versions 4.1.1.0 – 4.1.1.18; 4.2.0.0 – 4.2.0.4; 4.2.1.0 – 4.2.1.2; 4.2.2.0 – 4.2.2.3; 4.2.3.0 – 4.2.3.6 Vulnerable ·IBM
cpe:2.3:a:ibm:spectrum_scale:5.0.0.0:*:*:*:*:*:*:* Versions 5.0.0.0 Vulnerable ·IBM
cpe:2.3:a:ibm:general_parallel_file_system:4.1.0.0:*:*:*:*:*:*:* Versions 4.1.0.0 Vulnerable ·IBM
cpe:2.3:a:ibm:general_parallel_file_system:4.1.0.1:*:*:*:*:*:*:* Versions 4.1.0.1 Vulnerable ·IBM
cpe:2.3:a:ibm:general_parallel_file_system:4.1.0.2:*:*:*:*:*:*:* Versions 4.1.0.2 Vulnerable ·IBM
cpe:2.3:a:ibm:general_parallel_file_system:4.1.0.3:*:*:*:*:*:*:* Versions 4.1.0.3 Vulnerable ·IBM
cpe:2.3:a:ibm:general_parallel_file_system:4.1.0.4:*:*:*:*:*:*:* Versions 4.1.0.4 Vulnerable ·IBM
cpe:2.3:a:ibm:general_parallel_file_system:4.1.0.5:*:*:*:*:*:*:* Versions 4.1.0.5 Vulnerable ·IBM
cpe:2.3:a:ibm:general_parallel_file_system:4.1.0.6:*:*:*:*:*:*:* Versions 4.1.0.6 Vulnerable ·IBM
cpe:2.3:a:ibm:general_parallel_file_system:4.1.0.7:*:*:*:*:*:*:* Versions 4.1.0.7 Vulnerable ·IBM

Show 1 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:a:ibm:general_parallel_file_system:4.1.0.8:::::::*	4.1.0.8	Vulnerable	IBM

cpe:2.3:a:ibm:general_parallel_file_system:4.1.0.8:*:*:*:*:*:*:* Versions 4.1.0.8 Vulnerable ·IBM

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2017-1654
2026-10-03 Alias added: GHSA-4pmr-98gg-9wvp

References

Patch 1

http://www.ibm.com/support/docview.wss?uid=ssg1S1010869

TI-2015-00170 IBM General Parallel File System (GPFS) 3.4 before 3.4.0.32, 3.5 before 3.5.0.24, and 4.1… CVSS 2.0HIGH 10.0
TI-2016-05248 Memory corruption in IBM Spectrum Scale CVSS 3.0HIGH 7.2
TI-2018-01317 A vulnerability in GSKit affects IBM Spectrum Scale 4.1.1, 4.2.0, 4.2.1, 4.2.3, and 5.0.0… CVSS 3.0HIGH 7.8
TI-2016-00320 IBM General Parallel File System (GPFS) 3.5 before 3.5.0.29 efix 6 and 4.1.1 before… CVSS 3.0MEDIUM 6.5
TI-2015-04184 IBM General Parallel File System (GPFS) 3.5.x before 3.5.0.27 and 4.1.x before 4.1.1.2… CVSS 2.0HIGH 7.2
TI-2015-00169 IBM General Parallel File System (GPFS) 3.4 before 3.4.0.32, 3.5 before 3.5.0.24, and 4.1… CVSS 2.0HIGH 7.2

See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences