XenServer Security Update for Multiple Issues
CTX697256
Summary
An issue has been identified that may allow an unauthenticated attacker on the management network to eventually infer the Pool Secret and so compromise the host.
Products covered
XenServer
Remediation
We have pushed updates to both the Early Access and Normal update channels of each of XenServer 8.4 and XenServer 9.
We recommend that customers update to the latest version from their chosen channel following the instructions at https://docs.xenserver.com/us/en/xenserver/8/update.html or https://docs.xenserver.com/us/en/xenserver/9/update.html Customers who wish to rotate the Pool Secret should follow the instructions at https://docs.xenserver.com/us/en/xenserver/8/hosts-pools/manage-pools.html#rotate-the-pool-secret or https://docs.xenserver.com/us/en/xenserver/9/hosts-pools/manage-pools.html#rotate-the-pool-secret
CVEs in this advisory 10
Updates
- Published by Citrix
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.
- Confirmed at the source
Our collector saw this advisory during a later source check.